Clustering cell sites according to signaling behavior

ABSTRACT

Cells of a network can be clustered based on signaling behavior, and abnormal signaling conditions against cells can be detected and mitigated. A security management component (SMC) can determine a neural network (NN) of NNs that can be representative of the cell network based on analysis of first signal measurement data associated with the cells. The NN can cluster respective cells into respective clusters based on analysis of second signal measurement data associated with the cells. The NN can determine whether an abnormal signaling condition associated with a cell is occurring based on analysis of third signal measurement data associated with the cells, information relating to the cluster to which the cell is assigned, and a defined network security criterion. SMC can perform feature reforming on the first, second, and/or third signal measurement data to reduce dimensionality of such data to facilitate processing by the NN.

TECHNICAL FIELD

This disclosure relates generally to electronic communications, e.g., toclustering cell sites according to signaling behavior.

BACKGROUND

Communication devices can communicate data to other communicationdevices via a communication network. For example, a wireless device(e.g., mobile, cell, or smart phone; electronic tablet or pad; Internetof Things (IoT) device; or other type of wireless device) can connect toand communicate with a wireless communication network (e.g., corenetwork), via a base station associated with the wireless communicationnetwork, to communicate with another communication device connected tothe wireless communication network or to another communication network(e.g., Internet Protocol (IP)-based network, such as the Internet)associated with (e.g., communicatively connected to) the wirelesscommunication network. The wireless device can, for instance,communicate information to a base station and associated wirelesscommunication network (e.g., core network) via an uplink and can receiveinformation from the base station (and associated wireless communicationnetwork) via a downlink.

The above-described description is merely intended to provide acontextual overview regarding electronic communications, and is notintended to be exhaustive.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates a block diagram of an example system that candesirably cluster cells of a communication network (e.g., core orcellular network) based on signaling characteristics, and detectabnormal signaling conditions associated with cells, to facilitatedetecting and mitigating aggressive signaling and/or malicious events bycommunication devices against cells, in accordance with various aspectsand embodiments of the disclosed subject matter.

FIG. 2 depicts a block diagram of an example security managementcomponent, in accordance with various aspects and embodiments of thedisclosed subject matter.

FIG. 3 illustrates a diagram of an example feature reforming processthat can be performed on signal measurement data, in accordance withvarious aspects and embodiments of the disclosed subject matter.

FIG. 4 presents a diagram of an example graph of a time-series signalmeasurements of cells, in accordance with various aspects andembodiments of the disclosed subject matter.

FIG. 5 presents a diagram of an example graph that can illustrateexample time delays in cell activity and time-series signal measurementsfor different cell sites, in accordance with various aspects andembodiments of the disclosed subject matter.

FIG. 6 illustrates a block diagram of an example multi-stage process forneural network selection, cluster assignment, and detection of anomalousconditions associated with cells, in accordance with various aspects andembodiments of the disclosed subject matter.

FIG. 7 presents a diagram of an example graph that can comprise anencoded mapping of cells that can illustrate the spatial or graphicallayout of respective cells in a two-dimensional space, based at least inpart on the respective encoded reduced dimensionality vectors associatedwith the respective cells, and clustering of respective cells intorespective clusters, in accordance with various aspects and embodimentsof the disclosed subject matter.

FIG. 8 presents a diagram of an example graphs that can illustraterespective characteristics of respective cells and cell clusters withregard to signaling associated with cells, in accordance with variousaspects and embodiments of the disclosed subject matter.

FIG. 9 depicts a block diagram of an example communication deviceoperable to engage in a system architecture that facilitates wirelesscommunications according to one or more embodiments described herein.

FIG. 10 illustrates a block diagram of an example access point, inaccordance with various aspects and embodiments of the disclosed subjectmatter.

FIG. 11 illustrates a flow chart of an example method that can clustercells according to their normal signaling behavior and detect abnormalbehavior associated with a cell to facilitate detecting aggressivesignaling by communication devices against the cell, in accordance withvarious aspects and embodiments of the disclosed subject matter.

FIG. 12 depicts a flow chart of an example method that can performfeature reforming on signal measurement data associated with cells tofacilitate reducing the vector dimensionality of the signal measurementdata to facilitate enhancing encoding and/or decoding by neural networksto facilitate detection of abnormal conditions associated with cells, inaccordance with various aspects and embodiments of the disclosed subjectmatter.

FIG. 13 illustrates a flow chart of an example method that can determineand select a desirable neural network from a group of neural networkswhere the desired neural network can be employed to facilitate detectionof abnormal conditions associated with cells, in accordance with variousaspects and embodiments of the disclosed subject matter.

FIG. 14 depicts a flow chart of an example method that can desirablycluster cells into clusters where the clusters of cells can be used tofacilitate detection of abnormal conditions associated with cells, inaccordance with various aspects and embodiments of the disclosed subjectmatter.

FIG. 15 illustrates a flow chart of an example method that can detectabnormal conditions associated with cells, in accordance with variousaspects and embodiments of the disclosed subject matter.

FIG. 16 is a schematic block diagram illustrating a suitable computingenvironment in which the various embodiments of the embodimentsdescribed herein can be implemented.

DETAILED DESCRIPTION

Various aspects of the disclosed subject matter are now described withreference to the drawings, wherein like reference numerals are used torefer to like elements throughout. In the following description, forpurposes of explanation, numerous specific details are set forth inorder to provide a thorough understanding of one or more aspects. It maybe evident, however, that such aspect(s) may be practiced without thesespecific details. In other instances, well-known structures and devicesare shown in block diagram form in order to facilitate describing one ormore aspects.

Discussed herein are various aspects that relate to classifying andclustering cells of a communication network (e.g., core or cellularnetwork) according to the respective normal signaling behaviorassociated with the cells to facilitate detecting abnormal behavior(e.g., abnormal or aggressive signaling behavior) associated with acell(s) due to aggressive (e.g., excessive) signaling by certaincommunication devices associated with the cell(s). The aggressivesignaling can relate to a signaling storm and/or distributed denial ofservice (DDoS) attack being executed by certain communication devicesagainst the cell(s). The disclosed subject matter can employ a desired(e.g., suitable or most accurate) neural network and artificialintelligence (AI) and/or machine learning techniques and algorithms tofacilitate desirably (e.g., suitably or optimally) classifying andclustering cells based at least in part on their respective normalsignaling behavior. The disclosed subject matter also can generate andpresent (e.g., display or communicate) an alert (e.g., alert ornotification message) in response to detecting abnormal behaviorassociated with a cell to notifying a device or user regarding theabnormal behavior, and can facilitate performing one or more desiredactions (e.g., logging and learning about the abnormal behavior andcause of the abnormal behavior, determining a set of statistics relatingto the abnormal behavior and its cause, or performing a mitigationaction), which can include a mitigation action(s) (e.g., blocking orthrottling communication devices) to mitigate a cause (e.g., excessivesignaling by communication devices) of the abnormal behavior, inresponse to the detected abnormal behavior. The disclosed subject mattercan enhance detection and mitigation of aggressive signaling and/ormalicious events against cells of the communication network, enablecritical communications and/or benign communications to be communicatedvia the communication network without disruption, enhance the userexperience with regard to communications via the communication network,enhance security of the communication network, and enhance networkefficiency of the communication network.

The various aspects described herein can relate to new radio, which canbe deployed as a standalone radio access technology or as anon-standalone radio access technology assisted by another radio accesstechnology, such as Long Term Evolution (LTE), for example. It should benoted that although various aspects and embodiments have been describedherein in the context of 5G, or other next generation networks, thedisclosed aspects are not limited to 5G, a universal mobiletelecommunications system (UMTS) implementation, an LTE implementation,and/or other network implementations, as the techniques can also beapplied in 3G, or 4G systems. For example, aspects or features of thedisclosed embodiments can be exploited in substantially any wirelesscommunication technology. Such wireless communication technologies caninclude UMTS, global system for mobile communication (GSM), codedivision multiple access (CDMA), wideband CDMA (WCMDA), CDMA2000, timedivision multiple access (TDMA), frequency division multiple access(FDMA), multi-carrier CDMA (MC-CDMA), single-carrier CDMA (SC-CDMA),single-carrier FDMA (SC-FDMA), orthogonal frequency divisionmultiplexing (OFDM), discrete Fourier transform spread OFDM (DFT-spreadOFDM), single carrier FDMA (SC-FDMA), filter bank based multi-carrier(FBMC), zero tail DFT-spread-OFDM (ZT DFT-s-OFDM), generalized frequencydivision multiplexing (GFDM), fixed mobile convergence (FMC), universalfixed mobile convergence (UFMC), unique word OFDM (UW-OFDM), unique wordDFT-spread OFDM (UW DFT-Spread-OFDM), cyclic prefix OFDM (CP-OFDM),resource-block-filtered OFDM, wireless fidelity (Wi-Fi), worldwideinteroperability for microwave access (WiMAX), wireless local areanetwork (WLAN), general packet radio service (GPRS), enhanced GPRS,third generation partnership project (3GPP), LTE, LTE frequency divisionduplex (FDD), time division duplex (TDD), 5G, third generationpartnership project 2 (3GPP2), ultra mobile broadband (UMB), high speedpacket access (HSPA), evolved high speed packet access (HSPA+),high-speed downlink packet access (HSDPA), high-speed uplink packetaccess (HSUPA), Zigbee, or another institute of electrical andelectronics engineers (IEEE) 802.12 technology. In this regard, all orsubstantially all aspects disclosed herein can be exploited in legacytelecommunication technologies.

As used herein, “5G” can also be referred to as New Radio (NR) access.Accordingly, systems, methods, and/or machine-readable storage media forreducing interference on reference signals from other co-channelreference signals, and improving the channel estimation performance forchannel state information (CSI) estimation and data detection, in 5Gsystems, and other next generation systems, can be desired. As usedherein, one or more aspects of a 5G network can comprise, but is notlimited to, data rates of several tens of megabits per second (Mbps)supported for tens of thousands of users; at least one gigabit persecond (Gbps) that can be offered simultaneously to tens of users (e.g.,tens of workers on the same office floor); several hundreds of thousandsof simultaneous connections supported for massive sensor deployments;spectral efficiency that can be significantly enhanced compared to 4G;improvement in coverage relative to 4G; signaling efficiency that can beenhanced compared to 4G; and/or latency that can be significantlyreduced compared to LTE.

Multiple Input, Multiple Output (MIMO) technology can be employed incommunication networks, wherein MIMO technology can be an advancedantenna technique utilized to improve spectral efficiency and, thereby,boost overall system capacity. Spectral efficiency (also referred to asspectrum efficiency or bandwidth efficiency) refers to an informationrate that can be transmitted over a given bandwidth in a communicationsystem.

For MIMO, a notation (M×N) can be utilized to represent the MIMOconfiguration in terms of a number of transmit antennas (M) and a numberof receive antennas (N) on one end of the transmission system. Examplesof MIMO configurations used for various technologies can include: (2×1),(1×2), (2×2), (4×2), (8×2) and (2×4), (4×4), (8×4). The configurationsrepresented by (2×1) and (1×2) can be special cases of MIMO known astransmit and receive diversity.

In some cases, MIMO systems can significantly increase the data carryingcapacity of wireless communications systems. Further, MIMO can be usedfor achieving diversity gain, which refers to an increase insignal-to-interference ratio due to a diversity scheme and, thus, canrepresent how much the transmission power can be reduced when thediversity scheme is introduced, without a corresponding performanceloss. MIMO also can be used to achieve spatial multiplexing gain, whichcan be realized when a communications system is transmitting differentstreams of data from the same radio resource in separate spatialdimensions (e.g., data is sent/received over multiple channels, linkedto different pilot frequencies, over multiple antennas). Spatialmultiplexing gain can result in capacity gain without the need foradditional power or bandwidth. In addition, MIMO can be utilized torealize beamforming gain. Due to the benefits achieved, MIMO can be anintegral part of the third generation wireless system and the fourthgeneration wireless system. In addition, 5G systems also will employmassive MIMO systems (e.g., hundreds of antennas at the transmitter sideand receiver side). Typically, with a (N_(t), N_(r)), where N_(t)denotes the number of transmit antennas and N_(r) denotes the number ofreceive antennas, the peak data rate can multiply with a factor of N_(t)over single antenna systems in a rich scattering environment.

Communication devices can communicate information (e.g., voice and/ordata traffic) to other communication devices via a communicationnetwork, which can comprise a core network that can operate to enablewireless communication between communication devices. For example, awireless communication device (e.g., mobile, cell, or smart phone;electronic tablet or pad; computer; or other type of communicationdevice) can connect to and communicate with a wireless communicationnetwork (e.g., core network) to communicate with another communicationdevice connected to the wireless communication network or to anothercommunication network (e.g., Internet Protocol (IP)-based network, suchas the Internet) associated with (e.g., communicatively connected to)the wireless communication network.

Communication devices can operate and communicate via wireless orwireline communication connections (e.g., communication links orchannels) in a communication network to perform desired transfers ofdata (e.g., voice and/or data communications), utilize services, engagein transactions or other interactions, and/or perform other operations.In addition to wireless phones, electronic pads or tablets, andcomputers being used and connected to the communication network,increasingly Internet of Things (IoT) devices are being used andconnected to the communication network. The number of IoT devices beingemployed is expected to increase exponentially into the tens of billionsof IoT devices, which has been referred to as massive IoT. Massive IoTcan be one of the key service drivers for 5G and other next generationcommunication networks.

Many IoT devices can have security vulnerabilities, such as, forexample, Zero Day vulnerabilities, which can be security holes or flawsin the software of the IoT devices that can be unknown to the vendor andcan be exploited by malicious users (e.g., hackers or criminals).Malicious users can exploit such vulnerabilities in IoT devices, forexample, to create botnet armies by infecting IoT devices with stealthymalware (e.g., by surreptitiously installing stealthy malware on IoTdevices). This security threat can be expected to increase in magnitudedue to the “massive” factor in massive IoT.

One of the main goals of these botnet armies of infected IoT devices canbe to disrupt communication services, including mission critical 5G andother next generation services, of a communication network by means ofDDoS attacks, which also are known as signaling storms, which can becharacterized surges of a relatively large number of signaling messagesgenerated by one or more communication devices. Since 5G and other nextgeneration communication networks will facilitate massive IoT accessingthe 5G and other next generation radio access network (RAN), this canincrease the risk of RAN resource (e.g., 5G or other next generation RANresource) overload by means of DDoS attacks disrupting services,including mission critical 5G and other next generation services, of thecommunication network.

Core networks (e.g., mobility network) today do not have adequateprotection against DDoS attacks originated from devices that areconnected to the network. Currently, this is not expected to change with5G networks. Yet, 5G networks can be expected to support a significantlylarger number of devices, including massive IoT. Therefore, the threatlandscape posed by attacks originated by devices toward their networkcan be expected to grow significantly over the coming years.

While 3GPP standards do set some limits to the rate of signalingmessages each communication device is allowed to generate, it is oftenthe case that devices do exceed this limit by design and are able tooverride or get around such limits. For example, connected automobilescannot allow the implementation of the back off time defined by 3GPP towait 12 minutes after a few failed attach attempts to the core network.Connected automobiles have to be connected earlier than that 12 minutetime period. Because of this, connected automobile vendors override thismechanism to enable connected automobiles to avoid implementing the backoff time and, even after a few failed attach attempts, connectedautomobiles still can continue to make attach attempts without waiting12 minutes before doing so. While this is not unusual for connectedautomobiles, in other cases, for other types of devices, devicescontinuing to make attach attempts, after a few failed attach attempts,without waiting in accordance with the back off time can be consideredan anomaly. Furthermore, a single aggressive device typically does notpose a risk to the network. Rather, the problem can start when there area relatively large number of devices (e.g., thousands of devices) thatsimultaneously act aggressively against a cell or RAN.

Detecting signaling storms can be a challenging task because each cellcan have different signaling characteristics and what may be considerednormal behavior for one cell can be, in fact, a signaling storm foranother cell. Signaling characteristics and other characteristics ofcells can vary based at least in part on a variety of factors,including, for example, the activity level associated with a cell,location of the cell, terrain geography of the cell site of the cell,and/or other factors. For instance, a first cell or base station may bein a busy metropolitan area, a second cell or base station may belocated in a relatively rural and less busy area, a third cell or basestation may be located in an area where there are various significantobstructions (e.g., hills, mountains, or tall buildings) that can impactthe operation of the third cell or base station. A relatively highamount of signaling at a cell may be the norm for a cell located in abusy metropolitan area, while a relatively high amount of signaling at acell in a rural area may be an extreme anomaly. Another issue can bethat a cell may be located near a busy terminal of a subway station oran airport where all incoming passengers reconnect their devices (e.g.,mobile phones) simultaneously or substantially simultaneously becausethey just came out of a tunnel of the subway station or just got off aplane at the airport. This can result in a lot of devices sendingsignals to the cell simultaneously or substantially simultaneously,which is not abnormal under the circumstances. Further, it can bedifficult and/or impractical to build a profile for each cell in a corenetwork, since a core network can have hundreds of thousands of cells.Managing this magnitude of separate cell profiles and configurations canbe undesirably expansive. It can be desirable to have a dedicated policyfor determining whether a cell is under abnormal signaling stormconditions or not though.

There have been a few limited attempts to deal with attacks thatoriginate from devices within the network itself. However, traditionalefforts to try to protect the cellular network from attacks by devicesoriginated in the Internet or other carrier networks, and are notadequate or sufficient to detect and mitigate attacks by devices withinthe cellular network. Also, traditional techniques tend to merely focuson blocking devices, sometimes indiscriminately, and these traditionaltechniques are further deficient in that they do not provide a dedicatedanomaly detection configuration for each cell.

To that end, techniques for clustering cells of a network based onsignaling behavior, and detecting abnormal signaling conditionsassociated with cells, are presented. A security management component(SMC) can manage a multi-stage process for clustering cells of thenetwork based on signaling behavior of the cells, and detecting abnormalsignaling conditions associated with one or more of the cells. The SMCcan utilize AI and/or machine learning techniques and neural networks tocreate (e.g., automatically create, construct, or build) a normalbehavior profile (e.g., normal signaling behavior profile) for each cellof a group of cells of the network (e.g., core or cellular network) andgroup (e.g., cluster) cells with similar behavior to form cell clustersthat can have the same anomalous condition detection algorithms andconfiguration, using a clustering algorithm. The disclosed clusteringalgorithm for grouping cells into cell clusters can make it feasible toapply desirable (e.g., suitable or optimal) anomalous conditiondetection algorithms for each cell cluster type, which can therebyenable the detection of anomalous conditions associated with cells to bemore accurate, which can reduce or minimize instances of false positivedetection. Further, the SMC can provide a mechanism to communicate analert signal when anomalous behavior associated with a certain cell hasbeen detected by the SMC. This can enable appropriate action to be takenin response to the detected anomalous behavior.

As part of the first stage of the multi-stage process, the SMC canemploy a neural network (NN) component that can facilitate determining adesirable NN that can be utilized to determine a desirable (e.g., a mostaccurate) representation of a communication network (e.g., core orcellular network) of cells. The SMC can employ a feature reformercomponent that can process (e.g., perform feature reforming on) firstsignal measurement data representative of first signal measurements(e.g., time series of first signal measurements) of first signalsassociated with a group of cells to reduce the dimensionality the firstsignal measurements to respective frequency feature reduceddimensionality vectors associated with the respective cells of the groupof cells. Signals can comprise, for example, control signals or othertypes of signals (e.g., traffic signals, messages, or communications)that can be communicated by communication devices. Control signals cancomprise, for example, an attach request signal to request an attachmentto a cell or base station (e.g., an initial attach request or an updateattach request), a connection request signal to request a connection tothe cell or base station, a handover-related signal associated with ahandover of a communication device to or from the cell or base station,or another type of control signal.

The NN component can comprise a group of NNs that can be respectivelyconfigured based at least in part on respective parameters (e.g.,respective encoding and decoding parameters). The SMC or NN componentcan determine a NN of the group of NNs to utilize to determine arepresentation (e.g., a most accurate representation) of the cellularnetwork, comprising the group of cells based at least in part onanalysis (e.g., respective NN analyses) of the respective frequencyfeature reduced dimensionality vectors associated with the respectivecells. For instance, each NN of the group of NNs can respectively encodethe respective frequency feature reduced dimensionality vectorsassociated with the respective cells to generate respective encodedreduced dimensionality (e.g., 2×1) vectors that can have smaller vectordimensionality than the respective frequency feature reduceddimensionality vectors, in accordance with the respective parameters ofthe respective NNs. Each NN of the group of NNs also can respectivelydecode the respective encoded reduced dimensionality vectors associatedwith the respective cells to generate respective decoded versions of theencoded reduced dimensionality vectors, in accordance with therespective parameters of the respective NNs, wherein the respectivedecoded vectors can have vector dimensionality that can be the same asthe respective frequency feature reduced dimensionality vectors. The NNsessentially can decode the encoded vectors to reconstruct the frequencyfeature reduced dimensionality vectors as accurately as the NNs can,based at least in part on their respective parameters andconfigurations. The SMC or NN component can determine and select the NNof the group of NNs that can most accurately represent the cellularnetwork (e.g., determine and select the NN that can most accuratelydecode the encoded vectors such that the decoded vectors as output bythe NN most closely matches the frequency feature vectors input to theNN, as compared to the other NNs of the group of NNs).

The NN can be employed to cluster respective cells into respectiveclusters based at least in part on the results of an analysis of secondsignal measurement data representative of second signal measurements ofsecond signals associated with the cells, wherein the second signalmeasurement data can be different from or same as the first signalmeasurement data. The feature reformer component can process the secondsignal measurement data (e.g., time series of second signalmeasurements) of second signals associated with the group of cells toreduce the dimensionality the second signal measurements to respectivefrequency feature reduced dimensionality vectors associated with therespective cells. The NN can encode the respective frequency featurereduced dimensionality vectors associated with the respective cells togenerate respective encoded reduced dimensionality (e.g., 2×1) vectorsthat can have smaller vector dimensionality than the respectivefrequency feature reduced dimensionality vectors, in accordance with theparameters of the NN. The NN can determine the relative proximities(e.g., relative distances or numerical differences) of the respectiveencoded vectors associated with the respective cells to each other. TheNN can cluster (e.g., iteratively cluster) the respective cells based atleast in part on the relative proximities of the respective encodedvectors associated with the respective cells to each other, wherein, forexample, the NN can cluster (e.g., group) together cells that haveencoded vectors that are in relatively close proximity to each other toform a small cluster and can iteratively combine smaller cell clustersin relatively close proximity together to form larger clusters until adesired number of cell clusters is achieved. The SMC or NN can storeinformation relating to the respective clusters of cells in a cellcluster repository, wherein such information can indicate which cellsare in which clusters, respective vector ranges of the respective cellclusters, respective characteristics (e.g., signaling-relatedcharacteristics or classifications, cell types) of the respective cellclusters and/or respective cells of the clusters, respective geographiclocations of the respective cells, and/or other desired information.

Using the cell clusters, the NN can determine whether an abnormalsignaling condition associated with a cell is occurring based at leastin part on an analysis of third signal measurement data representativeof third signal measurements of third signals associated with the cells,information relating to the cluster to which the cell is assigned, and adefined network security criterion. The feature reformer component canprocess the third signal measurement data (e.g., time series of thirdsignal measurements) of third signals associated with the group of cellsto reduce the dimensionality the third signal measurements to respectivefrequency feature reduced dimensionality vectors associated with therespective cells. The NN can encode the respective frequency featurereduced dimensionality vectors associated with the respective cells togenerate respective encoded reduced dimensionality (e.g., 2×1) vectorsthat can have smaller vector dimensionality than the respectivefrequency feature reduced dimensionality vectors, in accordance with theparameters of the NN. With regard to a cell of a cell cluster, the NNcan compare the encoded reduced dimensionality vector associated withthe cell to the vector range associated with the cell cluster todetermine whether the encoded reduced dimensionality vector associatedwith the cell is located within or outside of the vector range of thecell cluster to which the cell has been assigned. If the NN determinesthat the encoded reduced dimensionality vector is within the vectorrange of the cell cluster, the NN can determine that no abnormalcondition (e.g., no abnormal signaling condition) has been detected withrespect to that cell. If, instead, the NN determines that the encodedreduced dimensionality vector is outside of the vector range of the cellcluster, the NN can determine that there is an indication that anabnormal condition (e.g., an abnormal signaling condition) is occurringor has occurred with respect to that cell. If an abnormal condition, orat least an indication of an abnormal condition, associated with a cellhas been detected, the SMC or NN can present (e.g., display orcommunicate) an alert signal (e.g., alert or notification message)regarding the detected abnormal (or potentially abnormal) condition toan interface component, a communication device, and/or a user forconsideration and/or further action (e.g., performing a mitigationaction or other action).

These and other aspects and embodiments of the disclosed subject matterwill now be described with respect to the drawings. It is to beappreciated and understood that, while various aspects and embodimentsof the disclosed subject matter are described herein with regard to 5Gand other next generation communication networks, the techniques of thedisclosed subject matter described herein can be utilized (e.g., appliedto), in same or similar form, to 4G communication networks, and thedisclosed subject matter includes all such aspects and embodimentsrelating to implementation of the techniques of the disclosed subjectmatter to 4G communication networks.

Referring now to the drawings, FIG. 1 illustrates a block diagram of anexample system 100 that can desirably cluster cells of a communicationnetwork (e.g., core or cellular network) based on signalingcharacteristics, and detect abnormal signaling conditions associatedwith cells, to facilitate detecting and mitigating aggressive signaling(e.g., excessive signaling) and/or malicious events (e.g., maliciousattacks) by communication devices (e.g., aggressive or maliciouscommunication devices) against cells, in accordance with various aspectsand embodiments of the disclosed subject matter. The system 100 canthereby detect aggressive communication devices undesirably actingagainst a cell (e.g., cell of a radio access network (RAN)) and/ormitigate such aggressive actions against the cell, while allowing othercommunication devices (e.g., benign, non-aggressive, and/ornon-malicious communication devices) to connect and communicate via thecell and/or RAN. The system 100 can comprise a communication network 102can comprise a mobility core network (e.g., a core, cellular, and/orwireless communication network). In some embodiments, the communicationnetwork 102 can comprise or be associated with a packet data network(e.g., an Internet Protocol (IP)-based network, such as the Internetand/or intranet) that can be associated with the mobility core network.

The communication network 102 (e.g., the mobility core network of thecommunication network 102) can operate to enable wireless communicationbetween communication devices and/or between a communication device andthe communication network 102. The communication network 102 cancomprise various components, such as network (NW) nodes (e.g., radionetwork nodes), that can be part of the communication network 102 tofacilitate communication of information between devices (e.g.,communication devices) that can be associated with (e.g.,communicatively connected to) the communication network 102. In someembodiments, the communication network 102 can employ MIMO technology tofacilitate data communications between devices (e.g., network devices,communication devices, or other type of device) associated with thecommunication network 102.

As used herein, the terms “network node,” “network node component,” and“network component” can be interchangeable with (or include) a network,a network controller, or any number of other network components.Further, as utilized herein, the non-limiting term radio network node,or network node can be used herein to refer to any type of network nodeserving communications devices and/or connected to other network nodes,network elements, or another network node from which the communicationsdevices can receive a radio signal. In cellular radio access networks(e.g., UMTS networks), network nodes can be referred to as basetransceiver stations (BTS), radio base station, radio network nodes,base stations, NodeB, eNodeB (e.g., evolved NodeB), and so on. In 5Gterminology, the network nodes can be referred to as gNodeB (e.g., gNB)devices. Network nodes also can comprise multiple antennas forperforming various transmission operations (e.g., MIMO operations). Anetwork node can comprise a cabinet and other protected enclosures, anantenna mast, and actual antennas. Network nodes can serve severalcells, also called sectors, depending on the configuration and type ofantenna. Network nodes can be, for example, Node B devices, base station(BS) devices, access point (AP) devices, TRPs, and radio access network(RAN) devices. Other examples of network nodes can includemulti-standard radio (MSR) nodes, comprising: an MSR BS, a gNodeB, aneNodeB, a network controller, a radio network controller (RNC), a basestation controller (BSC), a relay, a donor node controlling relay, aBTS, an AP, a transmission point, a transmission node, a Remote RadioUnit (RRU), a Remote Radio Head (RRH), nodes in distributed antennasystem (DAS), and the like. In accordance with various embodiments, anetwork node can be, can comprise, or can be associated with (e.g.,communicatively connected to) a network device of the communicationnetwork 102.

At given times, one or more communication devices, such as, for example,communication device 104, communication device 106, and communicationdevice 108, can connect or attempt to connect to the communicationnetwork 102 to communicate with other communication devices associatedwith the communication network 102. A communication device (e.g., 104,106, or 108) also can be referred to as, for example, a device, a mobiledevice, or a mobile communication device. The term communication devicecan be interchangeable with (or include) a UE or other terminology. Acommunication device (or UE or device) can refer to any type of wirelessdevice that can communicate with a radio network node in a cellular ormobile communication system. Examples of communication devices caninclude, but are not limited to, a device to device (D2D) UE, a machinetype UE or a UE capable of machine to machine (M2M) communication, aPersonal Digital Assistant (PDA), a tablet or pad (e.g., an electronictablet or pad), an electronic notebook, a mobile terminal, a cellularand/or smart phone, a computer (e.g., a laptop embedded equipment (LEE),a laptop mounted equipment (LME), or other type of computer), a smartmeter (e.g., a smart utility meter), a target device, devices and/orsensors that can monitor or sense conditions (e.g., health-relateddevices or sensors, such as heart monitors, blood pressure monitors,blood sugar monitors, health emergency detection and/or notificationdevices, or other type of health-related device or sensor), a broadbandcommunication device (e.g., a wireless, mobile, and/or residentialbroadband communication device, transceiver, gateway, and/or router), adongle (e.g., a Universal Serial Bus (USB) dongle), an electronic gamingdevice, electronic eyeglasses, headwear, or bodywear (e.g., electronicor smart eyeglasses, headwear (e.g., augmented reality (AR) or virtualreality (VR) headset), or bodywear (e.g., electronic or smart watch)having wireless communication functionality), a music or media player,speakers (e.g., powered speakers having wireless communicationfunctionality), an appliance (e.g., a toaster, a coffee maker, arefrigerator, an oven, or other type of appliance having wirelesscommunication functionality), a set-top box, an IP television (IPTV), adevice associated or integrated with a vehicle (e.g., automobile,airplane, bus, train, ship, or other type of vehicle), a virtualassistant (VA) device, a drone, a home or building automation device(e.g., security device, climate control device, lighting control device,or other type of home or building automation device), an industrial ormanufacturing related device, a farming or livestock ranch relateddevice, and/or any other type of communication devices (e.g., othertypes of IoTs).

It is noted that the various aspects of the disclosed subject matterdescribed herein can be applicable to single carrier as well as tomulticarrier (MC) or carrier aggregation (CA) operation of thecommunication device. The term carrier aggregation (CA) also can bereferred to (e.g., interchangeably called) “multi-carrier system,”“multi-cell operation,” “multi-carrier operation,” “multi-carrier”transmission and/or reception. In addition, the various aspectsdiscussed can be applied for Multi RAB (radio bearers) on some carriers(e.g., data plus speech can be simultaneously scheduled).

It is to be appreciated and understood that the terms element (e.g.,element in connection with an antenna), elements, and antenna ports alsocan be used interchangeably, but can carry the same meaning, in thissubject disclosure. In some embodiments, more than a single antennaelement can be mapped to a single antenna port.

As disclosed, communication network 102 (e.g., the mobility core networkof the communication network 102) can comprise various networkcomponents or devices, which can include one or more RANs, such as, forexample, RAN 110, wherein each RAN can comprise or be associated with aset of base stations (e.g., access points (APs), such as base station(BS) 112 and base station 114, that can serve communication deviceslocated in respective coverage areas served by respective base stationsin the mobility core network of the communication network 102. Therespective base stations (e.g., base stations 112 and 114) can beassociated with one or more sectors (not shown), wherein respectivesectors can comprise one or more respective cells, such as, for example,cells 116, 118, 120, 122, 124, and 126. The one or more cells can haverespective coverage areas that can form the coverage area covered by theone or more sectors. The respective communication devices can becommunicatively connected to the communication network 102 viarespective wireless or wireline communication connections with one ormore of the respective cells (e.g., cells 116, 118, 120, 122, 124, or126).

In some embodiments, the one or more RANs (e.g., RAN 110) can be anopen-RAN (O-RAN) that can employ an open interface that can supportinteroperability of devices (e.g., network devices) from differententities (e.g., vendors). The O-RAN can build or establish wirelessconnections through virtualization. In certain embodiments, the O-RANcan utilize a common platform that can reduce reliance on proprietaryplatforms of service providers. The O-RAN also can employ standardizedinterfaces and application programming interfaces (APIs) to facilitateopen source implementation of the O-RAN.

The number of communication devices, particularly IoT devices, beingutilized is increasing at a significant rate and can be expected tocontinue to increase significantly into the future (e.g., increase totens of billions of devices). While in most instances, the communicationdevices (e.g., 104, 106, or 108) and associated users can be attemptingto connect to the RAN 110 for appropriate or benign reasons, in someinstances, aggressive and/or malicious actors can utilize communicationdevices to attempt to connect to cells (e.g., cells 116, 118, 120, 122,124, or 126) of the RAN 110 to disrupt (e.g., obstruct or interrupt)services, such as mobility services, provided by the communicationnetwork 102, including the RAN 110. For example, malicious actors canutilize communication devices (e.g., 104 or 106), such as IoT devices,and exploit vulnerabilities of such devices (e.g., by installing malwareon such communication devices) to initiate a malicious event, such as aDDoS attack, against the RAN 110 or associated cell to overwhelm the RAN110 (e.g., RAN 110, and/or an associated base station or cell) anddisrupt the services provided by the RAN 110 and/or associatedcommunication network 102, including disrupting communication betweencommunication devices (e.g., non-malicious acting communication devices)connected to or attempting to connect to the RAN 110 and/or associatedcommunication network 102, as more fully described herein.

The disclosed subject matter can determine (e.g., intelligently,automatically, and/or dynamically) determine or characterize respectivesignaling behavior associated with cells (e.g., cells 116, 118, 120,122, 124, or 126), determine when a cell is or at least appears to beexperiencing abnormal signaling behavior, which can indicate that thecell is being subjected to undesirably excessive signaling bycommunication devices, and can perform (e.g., in real time orsubstantially in real time) a desired response action (e.g., mitigationaction or other action) to respond to the abnormal signaling behaviorand/or undesirable event (e.g., excessive signaling and/or maliciousevent) against the cell or associated RAN (e.g., RAN 110) by certain(e.g., aggressive, malicious, and/or malware infected) communicationdevices, as more fully described herein.

In some cases, there can be communication devices that are attempting toconnect to a RAN 110 (e.g., RAN 110, and/or an associated base stationor cell) to communicate benign messages and/or to communicate priority(e.g., high priority or critical) messages, via the RAN 110, to othercommunication devices associated with the communication network 102. Ifthere is aggressive communication (e.g., aggressive or excessivesignaling) and/or a malicious event against the RAN 110, the aggressivecommunication and/or malicious event, if not mitigated, can disruptservices of the RAN 110 to prevent a communication device attempting toconnect and communicate benign or priority message via the RAN 110,and/or, if all communication devices attempting to connect to the RAN110 during an aggressive communication and/or malicious event were to beblocked from connecting, that can undesirably (e.g., negatively) impactthe ability of benign (e.g., non-aggressive or otherwise appropriatelyacting) communication devices that are attempting to connect to the RAN110 to communicate benign or priority messages from doing so. Thedisclosed subject matter can desirably (e.g., intelligently,automatically, and/or dynamically in real time or substantially in realtime) manage communication connections of communication devices to theRAN 110 (e.g., RAN 110, and/or an associated base station or cell) andthe communication network 102 (e.g., core network), including detectingand mitigating excessive signaling (e.g., aggressive signaling) and/ormalicious events (e.g., malicious attacks) by communication devices(e.g., aggressive or malicious communication devices) against the RAN110, while allowing other communication devices (e.g., non-aggressiveand/or non-malicious communication devices) to connect (or remainconnected) and communicate via the base station 112 and/or RAN 110.

To that end, in some embodiments, the communication network 102 cancomprise or be associated with a security management component (SMC) 128that can manage various functions and resources of or associated withRANs (e.g., RAN 110) in real time or substantially close (e.g., near) toreal time. In some embodiments, the SMC 128 can be part of an O-RAN(e.g., part of an overall architecture of the O-RAN). To facilitatesecuring the RAN 110 and communication network 102 overall fromaggressive and/or malicious communication devices and/or maliciousevents (e.g., malicious attacks, such as DDoS attacks), the SMC 128 candesirably (e.g., suitably or optimally) group respective cells (e.g.,cells 116, 118, 120, 122, 124, or 126) of the communication network 102(e.g., core or cellular network) into respective cell clusters based atleast in part on respective signaling characteristics or behaviorassociated with respective cells, and can detect abnormal signalingconditions associated with cells, to facilitate detecting and mitigatingaggressive signaling (e.g., excessive signaling) and/or malicious events(e.g., malicious attacks) by communication devices (e.g., aggressive ormalicious communication devices) against cells and the RAN 110, inaccordance with defined communication management criteria, which cancomprise defined network security criteria. The SMC 128 also can manageconnection of communication devices (e.g., 104, 106, or 108) to the RAN110 (e.g., manage connection of communication devices during aggressivesignaling and/or malicious events), including the cells (e.g., cells116, 118, 120, 122, 124, or 126) and base stations (e.g., base stations112 or 114) associated with the RAN 110, in accordance with the definedcommunication management criteria. In some embodiments, the SMC 128, ora desired portion thereof, can employ or comprise a security application(e.g., anomalous signaling detection, malicious event, and/or DDoSapplication) to facilitate detecting anomalous signaling conditionsassociated with cells, facilitate detecting and mitigating aggressivesignaling and/or malicious events against the RAN 110, and managing(e.g., controlling) connections of communication devices to the RAN 110.In certain embodiments, the security application can be or can comprisea micro services application (e.g., xApp). In that regard, for instance,as part of the capabilities of the SMC 128 and/or a RAN intelligentcontroller (RIC) (not explicitly shown) associated with the SMC 128,xApps can be written or implemented on top of the RIC, and the SMC 128,or a desired portion thereof, can be or can comprise the securityapplication, which can be an xApp that can be implemented on top of theRIC.

Communication devices (e.g., 104, 106, or 108) can communicate controlsignals (e.g., attach requests or other types of control signals) orother types of communications (e.g., other types of signals) to cells(e.g., cells 116, 118, 120, 122, 124, or 126) with which thecommunication devices are associated, and, accordingly, associated basestations (e.g., base stations 112 or 114) and RAN 110, to facilitateobtaining services or resources from cell, base station, and RAN. Forinstance, a communication device (e.g., communication device 104) cancommunicate an initial attach request to the RAN 110 (e.g., via cell 116and base station 112) to request connection to the RAN 110, cancommunicate another type of attach request (e.g., update request, suchas an authentication update request, a packet data network (PDN) gateway(PGW) update request, or other type of update request) to the RAN 110 torequest another type of service or resources from the RAN 110, cancommunicate a connection request signal to the RAN 110 to request aconnection to the cell or base station (e.g., cell 116 or base station112), can communicate a handover-related signal associated with ahandover of a communication device to or from the cell or base station,or can communicate another type of control signal to the RAN 110.

When communication devices (e.g., 104, 106, or 108) communicate controlsignals (e.g., attach requests or other types of control signals) to theRAN 110 (e.g., via a cell and associated base station), the SMC 128 canreceive information comprising or relating to such control signals. TheRAN 110 and the SMC 128 can receive the information contained in thecontrol signal (e.g., in an attach request or other type of controlsignal) from the communication device (e.g., communication device 104)and/or can receive other information (e.g., other control signal-relatedinformation) from the communication device or network devices of thecommunication network 102. For instance, the RAN 110 can receive deviceidentifier information (e.g., international mobile equipment identity(IMEI) number, international mobile subscriber identity (IMSI) number,or other unique device identifier or serial number) that can identifythe communication device, device location information that can identifythe location of the communication device, device type information thatcan identify the type of device the communication device is, priorityinformation that can indicate or specify a priority level associatedwith the communication device or message associated with thecommunication device, time data (e.g., time stamp data) that canindicate the time of the attach request or type of communication ortime(s) associated with another item(s) of attach request-relatedinformation, metadata associated with the attach request and/orcommunication device, and/or other type of control signal-relatedinformation.

It is noted that, with regard to the device identifier information(e.g., IMEI, IMSI), while the RAN 110 can receive the device identifiers(e.g., IMEI, IMSI), the device identifiers are not revealed to the RAN110, because the network is not supposed to reveal device or subscriberidentifiers of communication devices in part because it is assumed thatthe radio interface can be more exposed to or compromised byeavesdropping, and antenna sites potentially can be physically accessed.For this reason, the RAN (e.g., RAN 110) and other network componentscan utilize temporal (e.g., temporary) random identifiers as a referenceto communication devices (e.g., mobile or wireless communicationdevices) and/or associated subscribers. Examples of temporal randomidentifiers can comprise cell radio network temporary identifier(C-RNTI) and temporary mobile subscriber identity (TMSI). A C-RNTI canbe a temporary unique identifier that can be used, instead of the IMEI,for example, for identifying the RRC connection and scheduling that canbe dedicated to a communication device. A TMSI can be a temporary uniqueidentifier that can be used, instead of the IMSI, to ensure or maintainthe privacy of the subscriber associated with a communication device.

The SMC 128 can analyze and process the respective signals (e.g.,control signals or other signals) received by respective cells (e.g.,cells 116, 118, 120, 122, 124, and/or 126) of the communication network102 over a desired time period (e.g., an hour, a day, a week, a month,or other desired period of time). The SMC 128 can generate signalmeasurement data based at least in part on the received signals (e.g.,raw signal data), wherein the signal measurement data can comprise, forexample, respective data regarding respective signal measurements timeseries associated with respective cells (e.g., cells 116, 118, 120, 122,124, and/or 126) of the group of cells. The length of time of a signalmeasurements time series associated with a cell can be virtually anydesired length of time (e.g., a day, a week, a month, or other desiredlength of time) and can have a desired granularity with regard to thetiming of measurements of the signals (e.g., measurements every minute,every five minutes, every ten minutes, every fifteen minutes, everyhour, every three hours, or every day, or another desired granularityfor the signaling measurements). The signal measurement data can have atime dimensionality (e.g., 96×1 time dimensionality, 144×1 timedimensionality, or other time dimensionality) that can be based at leastin part on the signaling measurement granularity and the time length ofmeasurements of the signal measurements time series.

The SMC 128 can manage a multi-stage (e.g., three stage) process forclustering cells of the network based on signaling behavior of the cells(e.g., cells 116, 118, 120, 122, 124, and/or 126), and detectingabnormal signaling conditions associated with one or more of the cells.The multi-stage process can comprise a first stage that can involveselection of a desirable neural network (NN) as part of training, asecond stage that can involve cell cluster assignment as part of thetraining, and a third stage that can comprise detecting or identifyingoutlier cells (e.g., a cell with an abnormal signaling condition). Aspart of the first stage of the multi-stage process, the SMC 128 canemploy a NN component 130 that can facilitate determining a desirable(e.g., suitable, appropriate, optimal, and/or most accurate) NN that canbe utilized to determine a desirable (e.g., suitable, appropriate,optimal, and/or most accurate) representation of the communicationnetwork 102 (e.g., core or cellular network) of cells, as more fullydescribed herein. The NN component 130 can comprise or can employ agroup of NNs, wherein the NN component 130 can initiate, operate, orconfigure respective NNs of the group of NNs based at least onrespective parameters (e.g., encoding parameters, decoding parameters,and/or other desired parameters). For instance, the NN component 130 NNcomponent 130 can initiate, operate, or configure a first NN of the NNgroup based at least in part on first parameters, initiate, operate, orconfigure a second NN of the NN group based at least in part on secondparameters, and/or initiate, operate, or configure a third NN of the NNgroup based at least in part on third parameters, and so on, up to adesired number of NNs.

The SMC 128 also can employ a feature reformer component 132 thatperform a feature reforming process on respective signal measurementdata representative of respective signal measurements of signalsassociated with respective cells (e.g., cells 116, 118, 120, 122, 124,and/or 126) to reform the signal measurement data with regard tofrequency and reduce the dimensionality of the signal measurement datato facilitate desirable processing (e.g., encoding and decoding) of suchdata by the desired NN or other NNs of the NN group, as more fullydescribed herein. The feature reformer component 132 can perform thefeature reforming process on signal measurement data during the first,second, and/or third stage of the multi-stage process. Signals cancomprise, for example, control signals or other types of signals (e.g.,traffic signals, messages, or communications) that can be communicatedby communication devices (e.g., communication devices 104, 106, or 108)to the cells (e.g., cells 116, 118, 120, 122, 124, or 126). Controlsignals can comprise, for example, an attach request signal to requestan attachment to a cell or base station (e.g., an initial attach requestor an update attach request), a connection request signal to request aconnection to the cell or base station, a handover-related signalassociated with a handover of a communication device to or from the cellor base station, or another type of control signal.

For instance, during the first stage of the multi-stage process, thefeature reformer component 132 can perform feature reforming firstsignal measurement data that can be representative of first signalmeasurements (e.g., respective time series of respective first signalmeasurements) of first signals associated with respective cells (e.g.,cells 116, 118, 120, 122, 124, and/or 126) of the group of cells totransform such data to the frequency domain and reduce thedimensionality the first signal measurements to respective frequencyfeature reduced dimensionality vectors associated with the respectivecells, as more fully described herein. As an example, if the respectivetimes series of the respective first signal measurements associated withthe respective cells (e.g., cells 116, 118, 120, 122, 124, and/or 126)is 96×1 (or some other relatively higher dimensionality), the featurereformer component 132 can perform feature reforming on such measurementdata to transform such measurement data to the frequency domain andreduce the dimensionality such measurement data to respective frequencyfeature reduced dimensionality (e.g., 24×1 or 48×1) vectors associatedwith the respective cells.

The NN component 130 can manage the NNs of the NN group to have each NNof the NN group respectively encode the respective frequency featurereduced dimensionality vectors associated with the respective cells togenerate respective encoded reduced dimensionality (e.g., 2×1) vectorsthat can have smaller vector dimensionality than the respectivefrequency feature reduced dimensionality vectors associated with therespective cells (e.g., cells 116, 118, 120, 122, 124, and/or 126), inaccordance with the respective parameters of the respective NNs. The NNcomponent 130 can manage the NNs of the NN group to have each NN of theNN group respectively decode the respective encoded reduceddimensionality vectors associated with the respective cells (e.g., cells116, 118, 120, 122, 124, and/or 126) to generate respective decodedversions of the encoded reduced dimensionality vectors, in accordancewith the respective parameters of the respective NNs, wherein therespective decoded vectors can have vector dimensionality (e.g., 24×1 or48×1) that can be the same as the respective frequency feature reduceddimensionality vectors that were input to each of the NNs. Each of theNNs essentially can decode the encoded vectors to reconstruct thefrequency feature reduced dimensionality vectors as accurately as eachof the NNs can, based at least in part on the respective parameters andconfigurations of the respective NNs. The NN component 130 (e.g., an NNof the NN component 130) can determine and select the NN of the NN groupthat can most accurately represent the cellular network as compared tothe other NNs of the NN group (e.g., can determine and select the NNthat can most accurately decode the encoded vectors such that thedecoded vectors as output by the NN most closely matches the frequencyfeature vectors input to the NN, as compared to the other NNs of the NNgroup).

During the second stage of the multi-stage process, the SMC 128 canutilize the desired (e.g., most accurate, suitable, or optimal) NN tocluster respective cells (e.g., cells 116, 118, 120, 122, 124, and/or126) into respective clusters of cells based at least in part on theresults of an analysis of second signal measurement data that can berepresentative of respective second signal measurements of respectivesecond signals associated with the respective cells. In accordance withvarious embodiments, the second signal measurement data can be differentfrom or same as the first signal measurement data. If the second signalmeasurement data is different from the first signal measurement data,the feature reformer component 132 can perform feature reforming on thesecond signal measurement data (e.g., respective time series of secondsignal measurements) of respective second signals associated with therespective cells (e.g., cells 116, 118, 120, 122, 124, and/or 126) toreduce the dimensionality the second signal measurements to respectivefrequency feature reduced dimensionality vectors associated with therespective cells. The NN (e.g., as controlled by the NN component 130)can encode the respective frequency feature reduced dimensionalityvectors associated with the respective cells to generate respectiveencoded reduced dimensionality (e.g., 2×1) vectors that can have smallervector dimensionality than the respective frequency feature reduceddimensionality (e.g., 24×1 or 48×1) vectors, in accordance with theparameters of the NN. The NN (e.g., as controlled by the NN component130) can determine the relative proximities (e.g., relative distances ornumerical differences) of the respective encoded vectors associated withthe respective cells to each other.

The NN (e.g., as controlled by the NN component 130) can cluster (e.g.,iteratively cluster) the respective cells (e.g., cells 116, 118, 120,122, 124, and/or 126) into a desired number of respective clusters basedat least in part on the relative proximities of the respective encodedvectors associated with the respective cells to each other, inaccordance with defined network security criteria. For example, the NNcan cluster (e.g., group) together cells that have encoded vectors thatare in relatively close proximity to each other to form a small clusterand can iteratively combine smaller cell clusters in relatively closeproximity together to form larger clusters until a desired number ofcell clusters is achieved. The NN component 130 or NN can storeinformation relating to the respective clusters of cells in a cellcluster repository 134 of or associated with the SMC 128, wherein suchcell cluster information can indicate which cells are in which cellclusters, respective vector ranges of the respective cell clusters,respective characteristics (e.g., signaling-related characteristics orclassifications, cell types, and/or other characteristics) of therespective cell clusters and/or respective cells of the respective cellclusters, respective geographic locations of the respective cells,and/or other desired information.

During the third stage of the multi-stage process, using the cellclusters, the NN (e.g., as controlled by the NN component 130) candetermine whether an abnormal (e.g., anomalous) signaling conditionassociated with a cell (e.g., cells 116, 118, 120, 122, 124, or 126) isoccurring or has occurred based at least in part on an analysis of thirdsignal measurement data that can be representative of respective thirdsignal measurements of respective third signals associated with therespective cells, information relating to the cluster to which the cellis assigned, and the defined network security criteria. The featurereformer component 132 can perform feature reforming on the third signalmeasurement data (e.g., respective time series of third signalmeasurements) of respective third signals associated with the respectivecells (e.g., cells 116, 118, 120, 122, 124, and/or 126) to reduce thedimensionality the third signal measurements to respective frequencyfeature reduced dimensionality vectors associated with the respectivecells. The NN (e.g., as controlled by the NN component 130) can encodethe respective frequency feature reduced dimensionality vectorsassociated with the respective cells to generate respective encodedreduced dimensionality (e.g., 2×1) vectors that can have smaller vectordimensionality than the respective frequency feature reduceddimensionality (e.g., 24×1 or 48×1) vectors, in accordance with theparameters of the NN. With regard to a cell (e.g., cells 116, 118, 120,122, 124, or 126) of a cell cluster, the NN (e.g., as controlled by theNN component 130) can compare the encoded reduced dimensionality vectorassociated with the cell to the vector range associated with the cellcluster to determine whether the encoded reduced dimensionality vectorassociated with the cell is located within or outside of the vectorrange of the cell cluster to which the cell has been assigned. If the NNdetermines that the encoded reduced dimensionality vector is within thevector range of the cell cluster, the NN (e.g., as controlled by the NNcomponent 130) can determine that no abnormal condition (e.g., noabnormal signaling condition) has been detected with respect to thatcell. If, instead, the NN determines that the encoded reduceddimensionality vector is outside of the vector range of the cellcluster, the NN (e.g., as controlled by the NN component 130) candetermine that there is at least an indication that an abnormalcondition (e.g., an abnormal signaling condition) is occurring or hasoccurred with respect to that cell. If an abnormal condition, or atleast an indication of an abnormal condition, associated with a cell(e.g., cells 116, 118, 120, 122, 124, or 126) has been detected, the SMC128 can present (e.g., display or communicate) an alert signal (e.g.,alert or notification message) regarding the detected abnormal (orpotentially abnormal) condition to an interface component, acommunication device (e.g., communication device 136), and/or a user forconsideration and/or further action (e.g., performing a mitigationaction or other action), such as more fully described herein.

Referring to FIGS. 2 and 3 (along with FIG. 1), FIG. 2 depicts a blockdiagram of the SMC 128, in accordance with various aspects andembodiments of the disclosed subject matter. FIG. 3 illustrates adiagram of an example feature reforming process 300 that can beperformed by the feature reformer component 132 on signal measurementdata, in accordance with various aspects and embodiments of thedisclosed subject matter. The feature reformer component 132 cancomprise a transformer component 202 that can transform data, such assignal measurement data, from the time domain to the frequency domain,and a truncation component 204 that can truncate data to facilitatereducing the dimensionality of signal measurement data, as more fullydescribed herein.

As depicted at reference numeral 302 of the feature reforming process300, the SMC 128, employing the feature reformer component 132 oranother component of the SMC 128, can process respective signalmeasurement data associated with respective cells (e.g., cells 116, 118,120, 122, 124, and/or 126) of the cell group for a defined time period(e.g., day, half-day, week, hour, month, or other desired time period)to form, for each cell, a respective time-intervaled signal measurementstime series, wherein the time interval can be selected as desired. Cellsoften can exhibit or have different expected normal signaling behaviorfor different times of the day, different days of the week, and/or forother reasons, such as described herein, so it can be desirable to formtime-intervaled signal measurements time series that comprise enoughmeasurement data over a long enough period of time to account for thevariations in activity and operations of the cells over time. Therefore,each timed measurement of cell activity (e.g., receiving of signals fromcommunication devices) can represent a different variable in the cellnetwork model that can be generated (e.g., created or formed) andupdated, by the SMC 128, to represent (e.g., to model and/or correspondto the activity of) the group of cells (e.g., cells 116, 118, 120, 122,124, and/or 126) of the communication network 102.

The SMC 128 or a user can determine or select a desired time intervalfor the signal measurements based at least in part on how online the SMC128 and the associated algorithms (e.g., anomaly detection algorithm,malicious event detection algorithm, or other algorithm, such asdescribed herein) are desired to be, in accordance with the definednetwork security criteria. For example, if anomaly detection (e.g.,abnormal signaling detection) and associated alerts (if any) are desiredat least in five minute intervals, it can be desirable to measure theactivity (e.g., receiving of signals from communication devices) ofcells at least at five-minute intervals, and to have the SMC 128 form,for each cell (e.g., cells 116, 118, 120, 122, 124, or 126), arespective five-minute interval signal measurements time series. Ifanomaly detection and associated alerts (if any) are desired at least inten minute (or hourly) intervals, it can be desirable to measure theactivity of cells at least at ten-minute (or hourly) intervals, and tohave the SMC 128 form, for each cell, a respective ten-minute (orone-hour) interval signal measurements time series. If the time intervalis five minutes, and the defined time period is one day, the respectivefive-minutes interval signal measurements time series for the respectivecells can have a dimensionality (e.g., time dimensionality) that can berelatively large (e.g., 96×1). As depicted at reference numeral 302, theexample measurements for the cell (e.g., cell with curr_cell_id:110002-10) are at five-minute intervals, where at the first timeinterval, 63 signal events (e.g., attach events) associated with thecell were measured or detected, at the second time interval, 49 signalevents associated with the cell were measured or detected, and so on.

The variables (e.g., the respective timed measurement of cell activityof the respective cells) can or may have correlation between them. Theresulting data set (e.g., respective time-intervaled signal measurementstime series associated with the respective cells) can comprise arelatively large set of inter-connected variables. In some embodiments,the SMC 128, employing the feature reformer component 132 and NNcomponent 130, can learn and/or determine coefficients between thedifferent variables of the set of variables, and can use thosecoefficients to facilitate desirably reducing the dimensionality of thedata set (e.g., set of variables) to a desirably small dimension, suchas, for example, two (e.g., 2×1 vectors). By reducing the dimension ofthe data set down to two, this can facilitate (e.g., can enable, canmake it easier for) the SMC 128, employing the feature reformercomponent 132 and NN component 130, to desirably create two-dimensional(2-D) clusters of cells.

To facilitate desirably reducing the dimensionality of the data set, thefeature reformer component 132 can utilize the feature reforming atfrequency bins associated with the data set to reduce the dimensions ofthe data set in half or to less than half, and the NN component 130,employing the desired (e.g., selected) NN, can utilize an encoderalgorithm (e.g., auto-encoder algorithm) to enforce or further reducethe dimension of the data set down to two (or other desirably smallerdimension number).

One reason for the feature reformer component 132 to utilize thedisclosed feature reforming can be that a traditional auto-encoderalgorithm typically is not able to desirably or fully exploit thetime-series properties (e.g., the time dependency) among all of themeasurement samples of the data set. Referring briefly to FIGS. 4 and 5(along with FIGS. 1-3), FIG. 4 presents a diagram of an example graph400 of a time-series signal measurements of cells, and FIG. 5 presents adiagram of an example graph 500 that can illustrate example time delaysin cell activity and time-series signal measurements for different cellsites, in accordance with various aspects and embodiments of thedisclosed subject matter. As can be observed in the graph 400 of FIG. 4,with regard to an averaged cell signal (e.g., cell attach) measurementtime series, the time-series signal measurements of cells typically canbe sinusoidal waveforms, or at least substantially close to beingsinusoidal waveforms, with such waveforms repeating daily or over otheridentifiable time periods. FFT at the frequency domain can be aparticularly useful tool to capture this type of periodicity andsinusoidal or substantially sinusoidal patterns, as FFT can transformthe signal measurement data to decompose the time-series signalmeasurements into different sinusoids (or at least substantiallysinusoidal waveforms).

As can be observed in the graph 500 of FIG. 5, which presents the numberof signal events (e.g., cell attach events) along the y-axis as afunction of time along the x-axis, different cells (e.g., cell 1 502,cell 2 504) often can have similar but different signal measurementwaveforms (e.g., waveform 506, waveform 508, respectively) where,although the signal measurement waveforms can be somewhat similar inform, such signal measurement waveforms can have different time delaysdue, for example, to the time difference between the different locationsof the cells (e.g., cell 1 502, cell 2 504) and/or different functionalzone patterns (e.g., residential vs. business) associated with thedifferent cells (e.g., cell 1 502, cell 2 504). These time delaydifferences can be problematic for a traditional auto-encoder, since theauto-encoder typically will treat the same traffic pattern withdifferent time zones as distinctive (e.g., different) patterns, eventhough the traffic patterns associated with the cells are the same orsubstantially the same, but merely are separated from each other by atime delay or difference. It can be desirable to not treat signalmeasurement time series of cells with time shifting or time delays asdifferent patterns. The disclosed feature reforming process 300, whichcan be performed by the feature reformer component 132, can eliminatethe confusion or problems that an auto-encoder can have with such timedelay differences due in part to the time shifting property of the FFT(e.g., time shifting of the measurement data in time series can have noimpact on and will not change the frequency domain magnitudes of thefrequency bins). Another advantage of the disclosed feature reformingprocess 300 can be that the feature reformer component 132 can performthe feature reforming process 300 over the frequency bins, since most ofthe high-frequency bins can be close to zero. This can facilitate (e.g.,enable) the feature reformer component 132 to reduce the dimensionalityof the signal measurement data by a desired amount (e.g., reduce thedimensionality of the data in half or even further) before feeding thesignal measurement data to the auto-encoder employed by the NN(s) andcan enhance the encoding robustness.

In that regard, as part of the feature reforming process 300, asindicated at reference numeral 304, for each cell, the feature reformercomponent 132 can employ the transformer component 202 to transform thetime-intervaled signal measurements time series associated with the cellfrom the time domain to the frequency domain by calculating the FFT ofthe time-intervaled signal measurements time series to generate a vector(e.g., 96×1 frequency vector) having the same relatively largerdimensionality (e.g., 96×1 or other relatively larger dimensionality) asthe time-intervaled signal measurements time series. The featurereformer component 132 can learn and/or determine coefficients betweenthe different variables of the set of variables of the vector that canbe representative of the time-intervaled signal measurements timeseries, and can use those coefficients to facilitate desirably reducingthe dimensionality of such data set to a desirably smaller dimension. Asdepicted at reference numeral 306 of the feature reforming process 300,using the learned or determined coefficients, the feature reformercomponent 132 can employ the truncation component 204 to truncate halfor more of the magnitudes of the absolute value of the FFT (e.g., |FFT|)at the high-frequency bins to generate a frequency feature reduceddimensionality vector that can have a desirably reduced (e.g., smaller)dimensionality (e.g., 24×1 or 48×1, or other smaller dimensionality)than the non-truncated (e.g., 96×1) frequency vector.

At this point, the frequency reforming can be completed, and, asindicated at reference numeral 308, the frequency feature reduceddimensionality vector can be input to an encoder component 206 (e.g.,auto-encoder) employed by one or more NNs of the NN component 130 (e.g.,one or more NNs during the first stage of the multi-stage process, orthe desired NN during the second stage and/or third stage of themulti-stage process), wherein, utilizing other learned or determinedcoefficients, the encoder component 206 can further reduce thedimensionality of the data set by encoding the frequency feature reduceddimensionality vector to generate an encoded reduced dimensionalityvector (e.g., vector (1.846971, 1.582182) for the example cell with cellid: 110002-10) that can have a desirably small dimensionality (e.g., 2×1or other desirably smaller dimensionality). Depending on theconfiguration and the parameters of the NN(s), the encoder component 206employed by the NN can encode each of the frequency feature reduceddimensionality vectors over several stages or iterations to reduce eachsuch vector until the encoded reduced dimensionality vector isultimately generated (e.g., can encode to reduce a frequency featurereduced dimensionality vector from 24×1 to 8×1, from 8×1 to 4×1, andfrom 4×1 to 2×1; or can encode to reduce a frequency feature reduceddimensionality vector from 24×1 to 12×1, from 12×1 to 8×1, from 8×1 to4×1, and from 4×1 to 2×1; or can otherwise encode the vector and reducethe dimensionality over a desired number of stages).

During the first stage of the multi-stage process, the NN component 130can utilize the respective encoded reduced dimensionality vectorsassociated with the respective cells (e.g., cells 116, 118, 120, 122,124, and/or 126) to facilitate determining a desirable (e.g., suitable,optimal, or most accurate) NN of the group of NNs to use to perform theclustering of cells and the anomaly detection), as more fully describedherein. During the second stage of the multi-stage process, the NNcomponent 130 can utilize the respective encoded reduced dimensionalityvectors associated with the respective cells (e.g., cells 116, 118, 120,122, 124, and/or 126) that are determined or generated during the secondstage to facilitate clustering respective cells into respectiveclusters), as more fully described herein. During the third stage of themulti-stage process, the NN component 130 can utilize the respectiveencoded reduced dimensionality vectors associated with the respectivecells (e.g., cells 116, 118, 120, 122, 124, and/or 126) that aredetermined or generated during the third stage to facilitate detectingan anomalous (e.g., an abnormal) condition(s) associated with a cell(s),as more fully described herein.

Turning to FIG. 6 (along with FIGS. 1 and 2), FIG. 6 illustrates a blockdiagram of an example multi-stage process 600 for NN selection, clusterassignment, and detection of anomalous conditions associated with cells,in accordance with various aspects and embodiments of the disclosedsubject matter. The example multi-stage process 600 can comprise thefirst stage (STAGE I), which can be part of the training and can beperformed by the SMC 128, employing the feature reformer component 132and the NN component 130, to determine and select a desirable NN, asindicated at reference numeral 602. The example multi-stage process 600also can comprise the second stage (STAGE II), which also can be part ofthe training and can be performed by the SMC 128, employing the featurereformer component 132 and the NN component 130, in particular thedesired NN, to assign respective cells to respective clusters of cells,as indicated at reference numeral 604. The example multi-stage process600 also can comprise the third stage (STAGE III), which can beperformed by the SMC 128, employing the feature reformer component 132and the NN component 130, in particular the desired NN, and usinginformation relating to the cell clusters, to detect outlier cells thatare experiencing anomalous conditions, as indicated at reference numeral606.

As part of the first stage 602 of the multi-stage process 600, the SMC128 can form respective first time-intervaled signal measurements timeseries associated with the respective cells (e.g., cells 116, 118, 120,122, 124, and/or 126) of the communication network 102 based at least inpart on the results of analyzing respective first signal data receivedfrom or with regard to the respective cells, as indicated at referencenumeral 608, and as more fully described herein. The feature reformercomponent 132 can analyze the respective first time-intervaled signalmeasurements time series, and, based at least in part on such analysis,can perform feature reforming on the respective first time-intervaledsignal measurements time series to generate respective frequency featurereduced dimensionality (e.g., 24×1 or 48×1) vectors associated with therespective cells (e.g., cells 116, 118, 120, 122, 124, and/or 126), asindicated at reference numerals 610 and 612, and as more fully describedherein.

As indicated at reference numeral 614 of the multi-stage process 600,the SMC 128 can input the respective frequency feature reduceddimensionality vectors associated with the respective cells (e.g., cells116, 118, 120, 122, 124, and/or 126) to respective NNs of the group ofNNs, and, using the encoder component 206 (e.g., auto-encoder) of the NNcomponent 130, the respective NNs each can encode the respectivefrequency feature reduced dimensionality vectors to generate respectiveencoded reduced dimensionality (e.g., 2×1) vectors associated with therespective cells, and, using decoder component 208 of the NN component130, can decode the respective encoded reduced dimensionality vectors togenerate respective decoded versions of the respective encoded reduceddimensionality vectors, wherein the respective decoded vectorsassociated with the cells can be output from each of the NNs. Therespective decoded vectors generated by each NN can be a reconstruction,by the NN (e.g., using the decoder component 208), of the respectivefrequency feature reduced dimensionality vectors input to the NN. Sincethe respective NNs can have different parameters and configurations, therespective encoding and decoding of vectors by the respective NNs canproduce different decoded vectors as output. In some embodiments, two ormore of the respective NNs can encode and decode vectors in parallel(e.g., concurrently).

As indicated at reference numeral 616, the NN component 130 (e.g., an NNof the NN component 130), using an NN selector component 210, candetermine and select a desirable (e.g., suitable, optimal, or mostaccurate) NN from the group of NNs based at least in part on the howaccurately the NNs represent the communication network 102 (e.g., thegroup of cells), in accordance with the defined network securitycriteria. For instance, for each NN, the NN selector component 210 cancompare the respective decoded vectors associated with the respectivecells that were generated by the NN to the respective frequency featurereduced dimensionality vectors associated with the respective cells thatwere input to the NN, and, based at least in part on the results of suchcomparison, can determine an amount of error between the respectivedecoded vectors and the respective frequency feature reduceddimensionality vectors. For instance, for each NN of the NN group, theNN selector component 210 can determine an amount of error between therespective decoded vectors and the respective frequency feature reduceddimensionality vectors as a function of the differences between therespective decoded vectors and the respective frequency feature reduceddimensionality vectors. The NN selector component 210 can determine theNN of the group of NNs that has the lowest amount of error between therespective decoded vectors at the output of the NN to the respectivefrequency feature reduced dimensionality vectors input to and encoded bythe NN, wherein the NN with the lowest amount of error can be the NNthat can most accurately represent the group of cells (e.g., cells 116,118, 120, 122, 124, and/or 126) of the communication network 102.

In some embodiments, as part of the second stage 604 of the multi-stageprocess 600, the SMC 128 can form respective second time-intervaledsignal measurements time series associated with the respective cells(e.g., cells 116, 118, 120, 122, 124, and/or 126) of the communicationnetwork 102 based at least in part on the results of analyzingrespective second signal data received from or with regard to therespective cells, as indicated at reference numeral 618, and as morefully described herein. The feature reformer component 132 can analyzethe respective second time-intervaled signal measurements time series,and, based at least in part on such analysis, can perform featurereforming on the respective second time-intervaled signal measurementstime series to generate respective frequency feature reduceddimensionality (e.g., 24×1 or 48×1) vectors associated with therespective cells (e.g., cells 116, 118, 120, 122, 124, and/or 126), asindicated at reference numerals 620 and 622, and as more fully describedherein. In other embodiments, if the second signal data is the same asthe first signal data, the SMC 128 can bypass forming the respectivesecond time-intervaled signal measurements time series, the featurereformer component 132 can bypass performing the feature reforming onthe respective second time-intervaled signal measurements time series,and the SMC 128 can utilize the respective frequency feature reduceddimensionality vectors associated with the respective cells that weregenerated during the first stage 602 of the multi-stage process 600.

As indicated at reference numeral 624 of the multi-stage process 600,the SMC 128 can input the respective frequency feature reduceddimensionality vectors associated with the respective cells (e.g., cells116, 118, 120, 122, 124, and/or 126) to the desired (e.g., selected,suitable, optimal, or most accurate) NN, and the NN (e.g., employing theencoder component 206) can encode the respective frequency featurereduced dimensionality vectors to generate respective encoded reduceddimensionality (e.g., 2×1) vectors associated with the respective cells.In some embodiments, each output point (e.g., each of the respectiveencoded reduced dimensionality vectors) output from the encodercomponent 206 can represent a reduced form of a signal measurement froma single cell (e.g., cell 116) at a single time (e.g., single moment orperiod in time). The output (e.g., the respective encoded reduceddimensionality vectors) from the NN (and associated encoder component206) can be overlayed in a 2-D area, and the clustering process can beperformed on the respective output points associated with the respectivecells e.g., cells 116, 118, 120, 122, 124, and/or 126).

As indicated at reference numeral 626, utilizing a cluster component 212of the NN component 130 and a clustering algorithm, the NN can clusterthe respective cells (e.g., cells 116, 118, 120, 122, 124, and/or 126)into respective clusters based at least in part on the results ofanalyzing (e.g., performing an NN analysis on) the respective encodedreduced dimensionality vectors associated with the respective cells. Forinstance, the desired NN (e.g., as controlled by the cluster component212) can cluster (e.g., iteratively cluster) the respective cells (e.g.,cells 116, 118, 120, 122, 124, and/or 126) into a desired number ofrespective clusters based at least in part on the relative proximitiesof the respective encoded reduced dimensionality vectors associated withthe respective cells to each other, in accordance with defined networksecurity criteria. For example, the NN (e.g., as controlled by thecluster component 212) can cluster (e.g., group) together cells thathave encoded reduced dimensionality vectors that are determined by theNN to be in relatively close proximity to each other (e.g., relativelyclose proximity to each other numerically based on their respectiveencoded vectors and/or relatively close proximity to each other based onthe spatial or graphical distance between the respective encoded vectors(e.g., as graphically plotted)) to form a small cluster. The NN (e.g.,as controlled by the cluster component 212) can iteratively combinesmaller cell clusters that are determined by the NN to be in relativelyclose proximity together to form larger clusters until a desired numberof cell clusters is achieved, in accordance with the defined networksecurity criteria (e.g., defined network security criteria relating toclustering of cells).

In some embodiments, the NN (e.g., as controlled by the clustercomponent 212) can continue to perform the clustering of cells until adefined number of clusters has been formed, wherein the defined numberof clusters (e.g., two clusters, three clusters, four clusters, fiveclusters, or more than five clusters) can be specified by the definednetwork security criteria and/or a user. In other embodiments, thenumber of clusters of cells to be formed can be determined by the NN(e.g., as controlled by the cluster component 212), wherein the NN canform as many clusters of cells as the NN determines to be suitable, orwherein the NN can form as many clusters of cells as the NN determinesto be suitable up to a defined maximum number of cell clusters, when andas specified by the defined network security criteria and/or the user.

As indicated at reference numeral 628 of the multi-stage process 600,the NN component 130 or the associated desired NN can store informationrelating to the respective clusters of cells in the cell clusterrepository 134 of or associated with the SMC 128. Such cell clusterinformation can indicate which cells (e.g., cells 116, 118, 120, 122,124, and/or 126) are in which cell clusters, respective vector ranges ofthe respective cell clusters, respective characteristics (e.g.,signaling-related characteristics or classifications, cell types, and/orother characteristics) of the respective cell clusters and/or respectivecells of the respective cell clusters, respective geographic locationsof the respective cells, and/or other desired information. In someembodiments, the clustering algorithm does not explicitly assign ameaning to each cell cluster or explain the meaning of each cellcluster. The SMC 128 and/or a user can assign a meaning to and/orexplain the meaning of each cell cluster based at least in part on theresults of observing and analyzing the respective cells (e.g., therespective signaling activity of the respective cells) of the respectivecell clusters. For instance, the SMC 128 and/or the user can observeand/or analyze the average amount of signaling over a defined periodand/or the maximum amount of signaling (e.g., over the defined period)with regard to cells and cell clusters, and can determine or identifyrespective characteristics of respective cells and/or respective cellclusters based at least in on the results of such analysis the averageamount of signaling and/or maximum amount of signaling, and can assignthe respective characteristics and/or corresponding meanings orexplanations to each cluster.

Referring briefly to FIGS. 7 and 8 (along with FIGS. 1, 2, and 6), FIG.7 presents a diagram of an example graph 700 that can comprise anencoded mapping of cells that can illustrate the spatial or graphicallayout of respective cells in a 2-D space (e.g., a 2-D area or graph),based at least in part on the respective encoded reduced dimensionalityvectors associated with the respective cells, and clustering ofrespective cells into respective clusters, in accordance with variousaspects and embodiments of the disclosed subject matter. FIG. 8 presentsa diagram of an example graphs 800 that can illustrate respectivecharacteristics (e.g., signaling-related characteristics) of respectivecells and cell clusters with regard to signaling associated with cells,in accordance with various aspects and embodiments of the disclosedsubject matter.

With further regard to the example graph 700 of FIG. 7, the examplegraph 700 comprises a scatter plot of an encoded mapping of cells thatcan illustrate the plotting of respective encoded reduced dimensionality(e.g., 2×1) vectors associated with respective cells for over 10,000time-intervaled signal measurements time series associated with the over10,000 respective cells as part of training using the multi-stageprocess 600, wherein the respective encoded reduced dimensionalityvectors can be determined by the desired NN, employing the encodercomponent 206, such as more fully described herein. Each encoded reduceddimensionality vector (x, y) can be plotted on the graph 700, whereinthe x variable of each respective encoded vector can be a respectivevalue along the x-axis of the graph 700 for each respective cell, andthe y variable of each respective encoded vector can be a respectivevalue along the y-axis of the graph 700 for each respective cell. As canbe observed in the graph 700, the desired NN, employing the clustercomponent 212, has clustered respective cells into respective clusters,comprising cell cluster 1 702, cell cluster 2 704, cell cluster 3 706,and cell cluster 4 708. In this example case, the defined number ofclusters was selected to be four, so four cell clusters have beenformed.

As also can be observed in the graph 700, most of the cells have beenclustered into cell cluster 1 702 and cell cluster 2 704, whereas cellcluster 3 706 and cell cluster 4 708 comprise only approximately 1% ofthe samples (e.g., approximately 1% of the encoded reduceddimensionality vectors associated with approximately 1% of the cells).As further can be observed, cell cluster 1 702 and cell cluster 2 704can be well defined, and accordingly, the respective characteristics ofcell cluster 1 702 and cell cluster 2 704, and the respectivecharacteristics of the respective cells within each of cell cluster 1702 and cell cluster 2 704, can be readily ascertainable by the SMC 128and/or the user. Cell cluster 3 706 and cell cluster 4 708 are not quiteas well defined as cell cluster 1 702 and cell cluster 2 704, althoughthe respective characteristics of cell cluster 3 706 and cell cluster 4708, and the respective characteristics of the respective cells withineach of cell cluster 3 706 and cell cluster 4 708, also can or may beascertained by the SMC 128 and/or the user, however, the SMC 128 and/orthe user may have to perform a more extensive analysis of the cellcluster 3 706 and/or cell cluster 4 708 in order to ascertain therespective characteristics of cell cluster 3 706 and cell cluster 4 708,and/or the respective characteristics of the respective cells withineach of cell cluster 3 706 and cell cluster 4 708.

With further regard to the example graphs 800 of FIG. 8 as well as thecell clusters, cell cluster 1 702, cell cluster 2 704, cell cluster 3706, and cell cluster 4 708, the graphs 800 can comprise graph 802,graph 804, graph 806, and graph 808 that each can comprise respectivedata points regarding respective encoded reduced dimensionality vectorsassociated with respective cells and information relating to therespective maximum or highest hourly signaling (e.g., cell attaches) andrespective average number of signaling associated with the respectivecells. The graph 802 can relate to cell cluster 1 702, the graph 804 canrelate to cell cluster 2 704, the graph 806 can relate to cell cluster 3706, and the graph 808 can relate to cell cluster 4 708.

Based at least in part on the results of analyzing the example graphs800 (and/or information, such as the signal measurement data and/or theencoded reduced dimensionality vectors, utilized to facilitategenerating the example graphs 800 and/or example graph 700), the SMC 128and/or the user can observe, determine, and/or identify respectivecharacteristics (e.g., signaling-related characteristics) relating tosignaling of the respective cells and cell clusters (e.g., 702, 704,706, and 708) in the example graphs 800, and/or can assign therespective characteristics relating to signaling to the respective cellsand respective cell clusters. The example graphs 800 (and/or theinformation, such as the signal measurement data and/or the encodedreduced dimensionality vectors, utilized to facilitate generating theexample graphs 800 and/or example graph 700) can be analyzed or observedwith regard to the maximum hourly signaling (e.g., maximum or highestnumber of hourly signaling, such as cell attaches) associated with thecells over the evaluated time period, the average number of signals(e.g., cell attaches) associated with the cells across all signalmeasurements during the evaluated time period, the maximum hourlysignaling versus the average number of signals associated with thecells, and/or other desired factors or characteristics, in accordancewith the defined network security criteria.

For instance, with regard to cell cluster 1 702, the SMC 128 and/or theuser can determine or identify that cell cluster 1 702 can have thecharacteristics of the cells of cluster 1 702 having relatively lowmaximum hourly signaling and relatively low average number of signals.With regard to cell cluster 2 704, the SMC 128 and/or the user candetermine or identify that cell cluster 2 704 can have thecharacteristics of the cells of cluster 2 704 having relatively highmaximum hourly signaling and relatively high average number of signals.With regard to cell cluster 3 706, the SMC 128 and/or the user candetermine or identify that cell cluster 3 706 can have thecharacteristics of the cells of cluster 3 706 having a relatively highratio of maximum hourly signaling in relation to average number ofsignals. With regard to cell cluster 4 708, the SMC 128 and/or the usercan determine or identify that cell cluster 4 708 can have thecharacteristics of the cells of cluster 4 708 having relatively highmaximum hourly signaling.

With further regard to FIG. 6 (along with FIGS. 1 and 2), after thetraining of stage 1 602 and stage 2 604 of the multi-stage process 600have been performed, the disclosed subject matter can have a set of cellclusters and an assigned cluster for each cell (e.g., cells 116, 118,120, 122, 124, and/or 126). As desired, periodically (e.g., once perweek, once per month, once per quarter, once per year, or once per otherdesired period) or aperiodically (e.g., dynamically in response toconditions being satisfied), the SMC 128 can perform the trainingstages, stage 1 602 and stage 2 604, of the multi-stage process to learnand capture changes to and/or trends in signaling behavior or activityassociated with the cells (e.g., cells 116, 118, 120, 122, 124, and/or126) of the communication network 102, in accordance with the definednetwork security criteria.

At this point or at another desired time, the SMC 128 and/or the usercan determine and assign respective parameters and/or respectivethreshold values relating to signaling associated with respective cells(e.g., cells 116, 118, 120, 122, 124, and/or 126) according to therespective cell clusters to which the respective cells have beenassigned to facilitate detection (e.g., automatic detection) ofanomalous (e.g., abnormal) signaling activity associated with cellsand/or aggressive (e.g., excessive signaling) communication devices(e.g., communication device 104), in accordance with the defined networksecurity criteria. The SMC 128 can store information regarding therespective parameters and/or respective threshold values in the cellcluster repository 134.

For example, the SMC 128 and/or the user can determine a respectivedefined threshold vector range for each cell cluster based at least inpart on (e.g., as a function of) the vector range that the cell clustercovers (e.g., based at least in part on the vector range associated withthe encoded reduced dimensionality vectors of the cells of the cluster),and can assign the respective defined threshold vector ranges to therespective cell clusters. In some embodiments, a defined thresholdvector range for a cell cluster can be the same as the vector rangeassociated with the cell cluster. In other embodiments, a definedthreshold vector range for a cell cluster can extend out by a desiredamount beyond the vector range associated with the cell cluster suchthat the defined threshold vector range can be larger than the vectorrange associated with the cell by the desired amount. By making thedefined threshold vector range larger than the vector range by a desiredamount (e.g., by adding a buffer amount to the vector range of the cellcluster when determining the defined threshold vector range), this canreduce over-alerting regarding potential abnormal signaling conditionsand/or false positives relating to abnormal signaling conditionsassociated with the cell cluster. There can be instances where anencoded reduced dimensionality vector associated with a cell may beclose to being in, but is outside of, the vector range of the cellcluster to which the cell is assigned. In such instances, it can or maybe desirable to treat the slightly “abnormal” signaling behaviorassociated with the cell as de minimis, and not trigger an alertindicating that the cell is experiencing abnormal signaling behavior.

As another example, as an alternative to, or in addition to, determiningand assigning defined threshold vector ranges to the cell clusters, theSMC 128 and/or the user can determine a respective defined thresholdnumber of signals (e.g., defined threshold maximum number of signals)for each cell cluster (e.g., over a defined time period) based at leastin part on (e.g., as a function of) the vector range that the cellcluster covers and/or a number of signals that can be determined tocorrespond to the vector range that the cell cluster covers, and canassign the respective defined threshold number of signals to therespective cell clusters. In some embodiments, a defined thresholdnumber of signals for a cell cluster can be the same as the number ofsignals that corresponds to the vector range associated with the cellcluster. In other embodiments, a defined threshold number of signals fora cell cluster can be higher, by a desired amount, than the number ofsignals that corresponds to the vector range associated with the cellcluster, to facilitate reducing or mitigating over-alerting regardingpotential abnormal signaling conditions and/or false positives regardingabnormal signaling conditions.

The third stage 606 of the multi-stage process 600 can be performed bythe SMC 128 (e.g., employing the feature reformer component 132 and theNN component 130, in particular the desired NN) using informationrelating to the cell clusters, to detect outlier cells that areexperiencing anomalous conditions. The detection in stage 3 606 can bedetection of an anomalous condition or behavior (e.g., an abnormal orexcessive signaling condition and/or change in behavior) associated witha cell (e.g., at the cell level) of a cell cluster, rather thandetection or identification of a particular communication device(s)(e.g., communication device 104) that is engaging in aggressive and/ormalicious activity (e.g., excessive and/or malicious signaling) againsta cell(s) of the communication network 102. The detection of ananomalous condition associated with a cell in stage 3 606 can provide atleast an indication that there is or at least may be excessive and/ormalicious signaling associated with the cell. In some embodiments, basedupon such detection of the anomalous condition, the SMC 128 can performanother detection process (e.g., a communication device detectionprocess) to determine or identify a particular communication device(s)that is or may be engaging in excessive signaling against the cell(s),as more fully described herein.

With further regard to the third stage 606, the SMC 128 can formrespective third time-intervaled signal measurements time seriesassociated with the respective cells (e.g., cells 116, 118, 120, 122,124, and/or 126) of the communication network 102 based at least in parton the results of analyzing respective third signal data received fromor with regard to the respective cells, as indicated at referencenumeral 630, and as more fully described herein. The feature reformercomponent 132 can analyze the respective third time-intervaled signalmeasurements time series, and, based at least in part on such analysis,can perform feature reforming on the respective third time-intervaledsignal measurements time series to generate respective frequency featurereduced dimensionality (e.g., 24×1 or 48×1) vectors associated with therespective cells (e.g., cells 116, 118, 120, 122, 124, and/or 126), asindicated at reference numerals 632 and 634, and as more fully describedherein.

As indicated at reference numeral 636 of the multi-stage process 600,the SMC 128 can input the respective frequency feature reduceddimensionality vectors associated with the respective cells (e.g., cells116, 118, 120, 122, 124, and/or 126) to the desired (e.g., selected,suitable, optimal, or most accurate) NN, and the NN (e.g., employing theencoder component 206) can encode the respective frequency featurereduced dimensionality vectors to generate respective encoded reduceddimensionality (e.g., 2×1) vectors associated with the respective cells.In some embodiments, each output point (e.g., each of the respectiveencoded reduced dimensionality vectors) output from the encodercomponent 206 can represent a reduced form of a signal measurement froma single cell (e.g., cell 116) at a single time (e.g., single moment orperiod in time). In certain embodiments, the output (e.g., therespective encoded reduced dimensionality vectors) from the NN (andassociated encoder component 206) can be overlayed in a 2-D area tofacilitate determining whether any encoded reduced dimensionality vectorassociated with a cell is located outside of the cell cluster to whichthat cell has been assigned.

As shown at reference numeral 638 of the multi-stage process 600, theSMC 128, employing a classifier component 214, can analyze therespective encoded reduced dimensionality vectors associated with therespective cells (e.g., cells 116, 118, 120, 122, 124, and/or 126) andinformation relating to the cell clusters, and can classify therespective cells, in relation to the respective cell clusters of therespective cells, based at least in part on the results of analyzing therespective encoded reduced dimensionality vectors and the informationrelating to the cell clusters, in accordance with the defined networksecurity criteria. For instance, the classifier component 214 canretrieve information relating to the cell clusters from the cell clusterrepository 134, wherein such information can identify the cells that arein each cell cluster, can identify the respective vector rangesassociated with the respective cell clusters, can identify respectiveparameters and/or respective threshold values (e.g., respective definedthreshold vector ranges and/or respective defined threshold number ofsignals) that are associated with the respective cell clusters, and/orcan comprise other desired (e.g., relevant) information relating to thecell clusters and associated cells.

For example, with regard to each cell, if, based at least in part on theresults of such analysis, the classifier component 214 determines thatan encoded reduced dimensionality vector associated with a particularcell is outside of the vector range associated with the cell cluster towhich the particular cell is assigned and/or the encoded reduceddimensionality vector satisfies (e.g., breaches or exceeds) a definedthreshold vector range associated with (e.g., applicable to) the cellcluster, the classifier component 214 can classify or identify theparticular cell as being outside of the vector range associated with thecell cluster and/or as having its encoded reduced dimensionality vectorsatisfy the defined threshold vector range associated with the cellcluster. If, instead, based at least in part on the results of suchanalysis, the classifier component 214 determines that an encodedreduced dimensionality vector associated with a particular cell iswithin the vector range associated with the cell cluster to which theparticular cell is assigned and/or the encoded reduced dimensionalityvector does not satisfy (e.g., does not breach or exceed) the definedthreshold vector range associated with the cell cluster, the classifiercomponent 214 can classify or identify the particular cell as beingwithin the vector range associated with the cell cluster and/or ashaving an encoded reduced dimensionality vector that does not satisfythe defined threshold vector range associated with the cell cluster.

As indicated at reference numeral 640 of the multi-stage process 600,with regard to the respective cells, based at least in part on theclassification results from the classifier component 214, the SMC 128,employing a cell anomaly detector component 216 (e.g., of the NNcomponent 130), can determine whether one or more cells of therespective cell clusters are experiencing or exhibiting an anomalouscondition (e.g., an anomalous or abnormal signaling condition), inaccordance with the defined network security criteria. For example, ifthe classification results indicate or specify that an encoded reduceddimensionality vector associated with a particular cell satisfies (e.g.,breaches or exceeds, or is outside of) the defined threshold vectorrange associated with the cell cluster, the cell anomaly detectorcomponent 216 can determine that the particular cell is experiencing orexhibiting an anomalous condition (e.g., an anomalous or abnormalsignaling condition), in accordance with the defined network securitycriteria. If, instead, based at least in part on the classificationresults, the cell anomaly detector component 216 determines that anencoded reduced dimensionality vector associated with a particular cellis within the vector range associated with the cell cluster to which theparticular cell is assigned and/or does not satisfy (e.g., does notbreach or exceed) the defined threshold vector range associated with thecell cluster, the cell anomaly detector component 216 can determine thatno anomalous condition associated with the particular cell is detected,in accordance with the defined network security criteria.

With further regard to FIGS. 1 and 2, the SMC 128 also can comprise analert component 218. In some embodiments, the cell anomaly detectorcomponent 216, in response to detecting that a particular cell isexperiencing or exhibiting an anomalous condition, the cell anomalydetector component 216 can communicate information indicating that theparticular cell is experiencing or exhibiting the anomalous condition tothe alert component 218. In response, the alert component 218 cangenerate an alert signal (e.g., alert or notification message) relatingto the detection of the anomalous condition, wherein the alert signalcan comprise information (e.g., alert information) that can relate to oridentify the particular cell (e.g., a cell identifier), characteristicsassociated with the particular cell or associated cell cluster, thedefined threshold vector range, the encoded reduced dimensionalityvector associated with the particular cell, a time that the anomalouscondition occurred or was detected, a location of the cell, and/or otherdesired (e.g., relevant) information. The alert component 218 cancommunicate the alert signal to a communication device (e.g.,communication device 136) associated with the user, an interfacecomponent associated with the user, a messaging account associated withthe user, and/or to another component(s) (e.g., detector component 220and/or connection manager component 222) of or associated with the SMC128. The user, detector component 220, connection manager component 222,or other component of the SMC 128 can review and evaluate theinformation (e.g., alert information) in the alert signal and can takeappropriate action in response to the alert signal, in accordance withthe defined network management criteria, as more fully described herein.

In accordance with various embodiments, if the detector component 220receives an alert signal indicating that an anomalous conditionassociated with a cell (e.g., cell 116) has been detected and/orotherwise receiving information indicating, or making a determination,that an anomalous condition associated with the cell has been detectedor is or has occurred, the detector component 220 can determine whetherone or more communication devices (e.g., communication device 104) areaggressive communication devices that are engaging in excessive and/ormalicious signaling against the cell (e.g., cell 116). As more fullydescribed herein, the RAN 110 and SMC 128 typically will not havestandard device identifiers or subscriber identifiers (e.g., IMEI, IMSI)available to identify individual communication devices and signalingbeing communicated by individual communication devices, and, instead,temporary identifiers (e.g., temporary random identifiers, such asC-RNTI and TMSI) can be assigned to communication devices (e.g.,communication devices 104, 106, or 108) and subscribers. The temporaryidentifiers for communication devices often can be changed, and, as aresult, the temporary identifiers typically may not be useful and/orcannot be used to identify which communication device sent which signal(e.g., control signal) to a cell.

The detector component 220 can overcome such problems. In accordancewith various embodiments, in response to receiving an alert signalindicating that an anomalous condition associated with a cell (e.g.,cell 116) has been detected and/or otherwise receiving informationindicating, or making a determination, that an anomalous conditionassociated with the cell has been detected or is or has occurred, thedetector component 220 can identify one or more communication devices(e.g., communication device 104) associated with the cell (e.g., cell116) based at least in part on the results of analyzing informationrelating to respective communication conditions associated withrespective communication devices (e.g., communication devices 104, 106,or 108) associated with (e.g., connected to) the base station. Thedetector component 220 can determine that a set of signaling can beattributed to a certain communication device (e.g., an aggressive orexcessive signaling, and/or malicious acting, communication device) byanalyzing the signal characteristics associated with the communicationdevice (e.g., communication device 104) in relation to (e.g., incontrast to) the signal characteristics of other communication devices(e.g., communication devices 106 or 108). For instance, the detectorcomponent 220 can identify measurements of communication conditions thatcan identify (e.g., be a communication signature of) a communicationdevice (e.g., communication device 104), wherein, for example, multiplesame or similar measurements of communication conditions can indicatethat such communication conditions are associated with the samecommunication device. The communication conditions associated with acommunication device (e.g., communication devices 104, 106, or 108) cancomprise, for example, a received signal strength indicator (RSSI), areceived signal received power (RSRP), a received signal receivedquality (RSRQ), a channel quality indicator (CQI), a signal tointerference and noise ratio (SINR), and/or a timing advance (TA)associated with the communication device. By identifying the respectivesignal characteristics (e.g., respective communication signatures) ofthe respective communication devices (e.g., communication devices 104,106, and/or 108), the detector component 220 can correlate signals ormessages associated with different temporary identifiers and canattribute all of those signals or messages to a single communicationdevice (e.g., an aggressive or excessive signaling, and/or maliciousacting, communication device (e.g., 104)), even though such signals ormessages are associated with different temporary identifiers.

In some embodiments, the \ detector component 220 can determine (e.g.,calculate) a calculated parameter value for a communication device(e.g., communication device 104, 106, or 108) based at least in part on(e.g., as a function of or as a combination of) a group of communicationcondition parameters (e.g., RSSI, RSRP, RSRQ, CQI, SINR, TA, and/oranother desired communication condition parameter) associated with thecommunication device, wherein the calculated parameter value canrepresent, at least in part, the communication signature associated withthe communication device. For instance, the detector component 220 candetermine a first calculated parameter value associated with a firstcommunication device (e.g., communication device 104) based at least inpart on a first group of communication condition parameters associatedwith the first communication device, and can determine a secondcalculated parameter value associated with a second communication device(e.g., communication device 106) based at least in part on a secondgroup of communication condition parameters associated with the secondcommunication device. The detector component 220 can distinguish betweenand identify the first communication device (e.g., communication device104) and the second communication device (e.g., communication device106) based at least in part on the results of analyzing the firstcalculated parameter value associated with the first communicationdevice and the second calculated parameter value associated with thesecond communication device.

By identifying or determining the respective signal characteristics(e.g., respective communication signatures) of the respectivecommunication devices, the detector component 220 can correlate signalsor messages associated with different temporary identifiers and canattribute all of those signals or messages to a single communicationdevice (e.g., an aggressive or excessive signaling, and/or maliciousacting, communication device), even though such signals or messages areassociated with different temporary identifiers. For example, the cell116 or associated base station 112 can receive a set of signals (e.g.,control signals, other type of signals, or messages) with temporalidentifiers from communication devices (e.g., communication devices 104,106, and/or 108), wherein the set of signals can comprise a first signalassociated with a first temporal identifier (e.g., 10), a second signalassociated with a second temporal identifier (e.g., 20), a third signalassociated with a third temporal identifier (e.g., 30), a fourth signalassociated with a fourth temporal identifier (e.g., 50), a fifth signalassociated with a fifth temporal identifier (e.g., 60), a sixth signalassociated with a sixth temporal identifier (e.g., 90), a seventh signalassociated with a seventh temporal identifier (e.g., 110), and an eighthsignal associated with an eighth temporal identifier (e.g., 160).

The detector component 220 can analyze the respective signalcharacteristics (e.g., RSSI, RSRP, RSRQ, CQI, SINR, TA, and/or othertype of signal characteristic (e.g., communication condition))associated with the respective signals of the respective signals of theset of signals. Based at least in part on the results of analyzing thesignal characteristics of the respective signals, the detector component220 can determine or identify that the respective signal characteristicsof the second signal, fourth signal, fifth signal, seventh signal, andeighth signal can be the same or substantially the same as each other,while the first signal, third signal, and sixth signal can haverelatively different signal characteristics than the second, fourth,fifth, seventh, and eighth signals. As a further result of suchanalysis, the detector component 220 can determine that a subset of thesignals (e.g., the second signal, fourth signal, fifth signal, seventhsignal, and eighth signal) can be attributed to the same communicationdevice (e.g., communication device 104), based at least in part on theresult of determining that the respective signal characteristics of therespective signals of the subset of signals are the same orsubstantially the same as each other (e.g., same or similar calculatedparameter values, same or similar RSSI values, same or similar RSRPvalues, same or similar RSRQ values, same or similar CQI values, same orsimilar SINR values, same or similar TA values, and/or same or similarother communication condition parameter values), even though the secondsignal, fourth signal, fifth signal, seventh signal, and eighth signalare associated with different temporal identifiers. The detectorcomponent 220 also can determine that the other signals (e.g., the firstsignal, third signal, and sixth signal) can be attributed to one or moreother communication devices (e.g., communication devices 106 and/or 108)based at least in part on the analysis results indicating that thesignal characteristics of these other signals are significantlydifferent from the signal characteristics of the subset of signalsattributed to the other communication device (e.g., communication device104).

While in many (e.g., most) cases a combination of measurements ofcommunication conditions can provide a sufficient communicationsignature associated with a communication device, there stillpotentially can be cases where false positives can occur with regard tothe identification of a communication device or whether a communicationdevice is acting in a benign manner or is engaging in excessivesignaling (e.g., where a benign communication device has similarmeasurements of communication conditions as an excessive signalingcommunication device). In some embodiments, to improve (e.g., increase)accuracy in identifying communication devices, in addition to analyzingcommunication conditions associated with communication devices (e.g.,communication devices 104, 106, and/or 108), the detector component 220can analyze respective configuration parameters and/or other informationassociated with respective communication devices to facilitateidentifying communication devices. The configuration parametersassociated with a communication device (e.g., communication devices 104,106, or 108) can comprise, for example, a quality of service classidentifier (QCI), allocation and retention priority (ARP) parameter, amobility management entity or access management function (MME/AMF) code,a MME/AMF group identifier, a band frequency associated with thecommunication device, or another desired configuration parameter.Different communication devices can or may have a differentconfiguration parameter or different groups of configuration parameters,which the detector component 220 can utilize to facilitatedistinguishing between and identifying communication devices.

The detector component 220 can analyze the configuration parameters, forexample, to confirm an identification of a communication device that wasdetermined based on the communication conditions associated with thatcommunication device, improve (e.g., increase) or at least attempt toimprove, a confidence level in the identification of the communicationdevice, and/or eliminate false positives. In certain embodiments, thedetector component 220 can determine (e.g., calculate) a calculatedparameter value for a communication device (e.g., communication device104, 106, or 108) based at least in part on (e.g., as a function of) thegroup of communication condition parameters and a group of configurationparameters (e.g., QCI, ARP, MME/AMF code, MME/AMF group identifier, bandfrequency, and/or another desired configuration parameter) associatedwith the communication device, wherein the calculated parameter valuecan represent, at least in part, the communication signature associatedwith the communication device.

The detector component 220 can evaluate one or more communicationdevices (e.g., one or more identified communication devices), and, foreach communication device (e.g., communication devices 104, 106, or108), can determine whether to classify the communication device as anexcessive signaling device based at least in part on whether the numberof control signals received from the communication device (e.g.,communication device 104) by the cell (e.g., cell 116) during a definedtime period satisfies (e.g., breaches, or meets or exceeds) a definedthreshold number of control signals that can be indicative of excessivesignaling by the communication device, in accordance with the definedcommunication management criteria. If the detector component 220determines that a communication device (e.g., communication device 106)does not satisfy (e.g., does not breach, or does not meet or exceed) thedefined threshold number of control signals, the detector component 220can determine that the communication device is not to be classified asan excessive signaling device. If, instead, the detector component 220determines that the communication device (e.g., communication device104) satisfies the defined threshold number of control signals, thedetector component 220 can determine that the communication device canbe classified as an excessive signaling (and/or malicious acting)device.

In response to determining that a communication device(s) (e.g.,communication device 104) is an excessive signaling and/or maliciousacting communication device, the detector component 220 can determine(e.g., calculate) and generate a set of statistics relating to theexcessive signaling of the communication device(s). In accordance withvarious embodiments, the detector component 220 can determine andgenerate a set of statistics with regard to an individual excessivesignaling communication device (e.g., communication device 104), or candetermine and generate a set of statistics for a group of excessivesignaling communication devices. The set of statistics can providedesired (e.g., relevant or suitable) information regarding the excessivesignaling to enable the SMC 128 or user to learn more about theexcessive signaling and/or to facilitate making determinations regardinghow to respond to the excessive signaling (e.g., taking mitigationaction to mitigate the excessive signaling). The set of statistics cancomprise a device identifier (e.g., UE_ID) that the detector component220 can assign to an excessive signaling communication device tofacilitate identifying the communication device (e.g., since the IMEIand IMSI are not available to the detector component 220).

The set of statistics also can comprise an exception level, which canindicate the how exceptional or concerning the excessive signaling ofthe excessive signaling communication device is. The detector component220 can determine the exception level based at least in part on one ormore defined threshold exception levels and the results of analyzinginformation relating to the excessive signaling of a communicationdevice. The exception levels can relate to respective responsecategories, such as, for example, alert (e.g., alert the SMC 128,communication network 102, or user about the detected excessivesignaling), log and learn (e.g., track and log more informationregarding the excessive signaling to learn more about the excessivesignaling and/or excessive signaling device(s)), throttle (e.g.,recommend, suggest, or indicate that the excessive signaling isparticularly problematic or harmful, or potentially harmful, to the RAN110, cell 116, base station 112, or communication network 102, andthrottling (e.g., partially blocking) of the excessive signalingdevice(s) to block at least a portion of the attempts by the device toattach to, connect to, or communicate with the cell 116 (or other cells)may be warranted), block (e.g., recommend, suggest, or indicate that theexcessive signaling is particularly problematic or harmful, orpotentially harmful, to the RAN 110, cell 116, base station 112, orcommunication network 102, and blocking of the excessive signalingdevice(s) may be warranted), or another desired response category. Ifthe detector component 220 determines that a lower defined thresholdexception level has been satisfied with regard to an excessive signalingcommunication device, the detector component 220 can assign a relativelylower exception level (e.g., alert exception level, or log and learnexception level) to the excessive signaling communication device. If thedetector component 220 determines that a higher (e.g., highest) definedthreshold exception level has been satisfied with regard to an excessivesignaling communication device, the detector component 220 can assign ahigher exception level (e.g., block exception level) to the excessivesignaling communication device.

The set of statistics also can comprise an exception trend. Based atleast in part on the results of analyzing information relating to theexcessive signaling of a communication device (e.g., communicationdevice 104), the detector component 220 can determine an exception trendof the signaling by the communication device. For instance, if thedetector component 220 determines that the signaling by the excessivesignaling communication device has been increasing over time, thedetector component 220 can determine that the excessive signaling istrending upward and can indicate that the exception trend is upward. If,instead, the detector component 220 determines that the signaling by theexcessive signaling communication device has been decreasing over time,the detector component 220 can determine that the excessive signaling istrending downward and can indicate that the exception trend is downward.If, instead, the detector component 220 determines that the signaling bythe excessive signaling communication device has been relatively stableover time, the detector component 220 can determine that the excessivesignaling is relatively stable and can indicate that the exception trendis stable. If, instead, the detector component 220 is unable todetermine the trend of the signaling by the excessive signalingcommunication device, the detector component 220 can indicate that theexception trend is unknown.

In some embodiments, the set of statistics can comprise calculatedperiodic communication values. For example, the detector component 220can determine an average number of control signals (e.g., attachsignals, update signals, or other type of control signal) associatedwith an excessive signaling communication device (e.g., communicationdevice 104) over each time period of a set of time periods. The averagenumber can be or represent a true average, a median, a mean, a mode, orother mid-point value that can represent or indicate a level orfrequency of control signaling over a particular time period. As anotherexample, the detector component 220 can determine a variance valuerelating to the communication of control signals by an excessivesignaling communication device. The variance value can indicate whetherthere is one or more spikes (e.g., peaks) in control signaling by theexcessive signaling communication device (e.g., one or more time periodswhere the excessive signaling spikes higher relative to one or moreother time periods where the signaling is relatively lower). Thedetector component 220 can determine the exception trend based at leastin part on the periodic communication values.

The set of statistics also can include time information, such as a starttime(s) and end time(s), associated with the various other statistics ofthe set of statistics. For instance, a start and stop time can be over aone-minute period, a one-hour period, a one-day period, a one-weekperiod, a one-month period, a one-year period, or other desired periodof time.

The set of statistics further can comprise a confidence level(s) thatcan indicate the level of confidence in the identification of acommunication device (e.g., communication device 104), the level ofconfidence in a determination that a communication device is anexcessive signaling and/or maliciously acting communication device,and/or an overall confidence level relating to the identification of thecommunication device and determination that it is an excessive signalingdevice. The detector component 220 can determine (e.g., calculate) aconfidence level(s) based at least in part on the results of analyzingthe group of communication condition parameters, the group ofconfiguration parameters, calculated parameter values, and/or otherdesired (e.g., relevant or suitable) information associated with acommunication device(s). For instance, if a group of calculatedparameter values are relatively consistent (e.g., same or substantiallythe same) over a period of time, the detector component 220 candetermine that there is a relatively high confidence level that thecalculated parameter values of the group of calculated parameter valuesare associated with a same communication device (e.g., communicationdevice 104) and the group of calculated parameter values can represent acommunication signature of the communication device. If, instead, agroup of calculated parameter values is not very consistent (e.g., varysomewhat relative to each other) over a period of time, the detectorcomponent 220 can determine that there is a relatively lower confidencelevel that the calculated parameter values of the group of calculatedparameter values are associated with a same communication device.

As another example, if the detector component 220 determines that anidentified communication device (e.g., communication device 104) hasbeen excessively signaling on a relatively consistent basis over anumber of periods of time, the detector component 220 can determine thatthere is a relatively high confidence level that the communicationdevice is an excessive signaling communication device. If, instead, thedetector component 220 determines that an identified communicationdevice was excessively signaling on a relatively inconsistent basis overa number of periods of time (e.g., where the communication device wasdetermined to be excessively signaling over one or a small number ofperiods of time, but not excessive signaling over most of the periods oftime under consideration), the detector component 220 can determine thatthere is a relatively lower confidence level that the communicationdevice is an excessive signaling communication device.

In certain embodiments, to facilitate determining whether acommunication device (e.g., communication device 104, 106, or 108) is anaggressive (e.g., excessive signaling and/or malicious acting)communication device, determining a level of aggressiveness (e.g.,excessive signaling) of an excessive signaling communication device,and/or determining a type of communication device that is engaging inaggressive behavior against the RAN 110, a cell (e.g., cell 116), and/ora base station (e.g., base station 112), the detector component 220 canreceive information relating to device type reputations of communicationdevices via a desired interface from the core network of thecommunication network 102. While information relating to device typereputations of communication devices may not always be available to thedetector component 220, in some instance, the detector component 220 canobtain such information from the core network.

For example, if a communication device (e.g., communication device 104)is an aggressive communication device that was not yet identified asaggressive (e.g., excessive signaling) by the detector component 220 orwas not blocked by the SMC 128, the communication device can be allowedto continue its registration attempt all the way to the core network(e.g., using non-access stratum (NAS) messages). In such instances, thedevice identifiers (e.g., IMEI, IMSI) can be revealed to the corenetwork and information relating to the device identifiers (but not thedevice identifiers themselves) can be received by the detector component220.

Such information can comprise, for example, the device vendor and modelof a communication device, which can be represented in the typeallocation code (TAC) associated with the communication device (e.g.,communication device 104). The TAC of a communication device (e.g.,communication device 104, 106, or 108) can be mapped to the C-RNTIand/or TMSI, wherein such mapping can be part of the informationrelating to the device type reputation that can be received by thedetector component 220. The device type reputation information can beuseful to facilitate detecting aggressive communication devices of acertain type (e.g., device vendor and/or device model) that can orpotentially can engage in common aggressive behavior (e.g., due to avulnerability in the type of communication device that renders itsusceptible to being infected with malware).

The detector component 220 can maintain information relating to thedevice type reputations of devices, including information regardingcommon aggressive behavior of certain types (e.g., certain devicevendor(s) and/or device model(s)) of communication devices (e.g.,communication devices 104, 106, and/or 108). The detector component 220also can maintain information regarding signaling patterns of certaintypes of communication devices. The detector component 220 can use theinformation regarding common aggressive behavior of certain types ofcommunication devices and/or the information regarding signalingpatterns of certain types of communication devices to facilitatedetecting aggressive communication devices and/or determining whencertain types of communication devices, while engaging in relativelyhigher levels of communicating control signaling than othercommunication devices, are not aggressive signaling devices, but ratherare devices that merely engage in more signaling than other types ofcommunication devices. Information relating to the device typereputations of communication devices, such as, for example, certaininformation relating to certain types (e.g., certain device vendor(s)and/or device model(s)) of communication devices, can be attributed(e.g., by the detector component 220) to all future attempts (e.g.,attach attempts or other control signaling) to signal the core networkby communication devices of that certain type, as the temporaryidentifiers of the certain types of communication devices can be mappedto the TAC.

Information relating to common aggressive behavior of certain types ofcommunication devices can be useful (e.g., helpful) in cases, forexample, where the detector component 220 can know a-priory that acertain device model has a vulnerability that can cause the certaindevice model of communication device to undesirably (e.g., excessively)attempt to attach to the core network once every two seconds, or anotherparticular device model has a vulnerability that can cause theparticular device model of communication device to undesirably (e.g.,excessively) attempt to attach to the core network every time theparticular device model of communication device is moved. As part of itsanalysis to determine whether a communication device(s) (e.g.,communication devices 104, 106, and/or 108) is an aggressive (e.g.,excessive signaling) communication device, the detector component 220can analyze the information relating to device type information, theinformation relating to cell classification or an anomalous conditionassociated with a cell (e.g., cell 116), and other received information(e.g., information relating to communication conditions, and/orinformation relating to configuration parameters), and based at least inpart on the analysis results, can determine whether a communicationdevice(s) (e.g., communication devices 104, 106, and/or 108) is anaggressive communication devices(s), in accordance with the definedcommunication management criteria. This can enable the detectorcomponent 220 to more accurately determine whether a communicationdevice is an aggressive communication device or not (e.g., can reducefalse positive determinations of aggressive signaling by devices, and/orcan reduce false positive determinations of benign actions bycommunication devices that actually are aggressive communicationdevices).

As another example, a particular type of communication device (e.g.,particular device vendor(s) and/or device model(s)) can, as part ofnormal operation, communicate a relatively higher number of controlsignals to a cell (e.g., cell 116) than other types of communicationdevices. The detector component 220 can receive information relating tothe device type information of such particular type of communicationdevice, and can take into account (e.g., incorporate into its analysis)that this particular type of communication device, as part of its normaloperation, communicates a relatively higher number of control signals tothe base stations. This can enable the detector component 220 to be moreaccurate in determining whether a communication device (e.g., theparticular type of communication device) is an aggressive communicationdevice or not, as this can reduce false positive determinations thatthis particular type of communication device is an aggressivecommunication device in instances where such communication device ismerely engaging in normal (albeit a relatively higher level of)communication of control signaling to a cell (e.g., cell 116).

As disclosed, the SMC 128 also can comprise the connection managercomponent 222. The connection manager component 222 can determinewhether to perform a mitigation action or other action (e.g., loggingand learning action, alert action) with regard to an aggressive (e.g.,excessive signaling) communication device (e.g., communication device104) based at least in part on the information, including the set ofstatistics, received from the detector component 220, in accordance withthe defined communication management criteria. For example, if, based atleast in part on the results of the analysis of the set of statisticsand/or other information relating to a communication device (e.g.,communication device 104), the connection manager component 222determines that the exception level is not too high (e.g., level ofexcessive signaling is not too high) and/or the exception trend is notindicating that the excessive signaling is trending upward, theconnection manager component 222 can or may determine that an action(s),such as an alert action or a logging and learning action, other thanblocking or throttling of the communication device (e.g., communicationdevice 104) can be the action(s) to be performed (e.g., by the SMC 128),when doing so is in accordance with the defined communication managementcriteria. In response to determining that an alert action or a loggingand learning action is to be performed with regard to the communicationdevice (e.g., communication device 104), the connection managercomponent 222 can generate alert instructions or logging and learninginstructions and can communicate the alert instructions or logging andlearning instructions to the RAN 110, base station 112, cell 116,detector component 220, another component of the SMC 128, anothercomponent of the communication network 102, or the communication device136 associated with the user. In response to such instructions, the RAN110, base station 112, cell 116, detector component 220, anothercomponent of the SMC 128, another component of the communication network102, or communication device 136 can generate an alert regarding theexcessive signaling communication device (e.g., to alert the user or acomponent of or associated with the core network regarding the excessivesignaling communication device), or can log information regarding theexcessive signaling communication device to facilitate learning moreabout the excessive signaling communication device, other similarexcessive signaling communication devices, and/or vulnerabilities ormalware associated with the excessive signaling communication device.

As another example, if, based at least in part on the results of theanalysis of the set of statistics and/or other information relating to acommunication device (e.g., communication device 104), the connectionmanager component 222 determines that the exception level is relativelyhigh (e.g., level of excessive signaling is relatively high) and/or theexception trend is indicating that the excessive signaling is trendingupward (e.g., and is at or is heading towards a relatively high level),the connection manager component 222 can or may determine that amitigation action to block or throttle the communication device (e.g.,communication device 104) can be the action(s) to be performed (e.g., bythe SMC 128), when doing so is in accordance with the definedcommunication management criteria. In response to determining that themitigation action to block the communication device (e.g., communicationdevice 104) is to be performed, the connection manager component 222 cangenerate blocking instructions and can communicate the blockinginstructions to the base station 112 or cell 116. In response to theblocking instructions, the base station 112 or cell 116 can block ordisconnect the excessive signaling communication device (e.g.,communication device 104) to disconnect the communication from the basestation 112 or cell 116, or can prevent the communication device fromconnecting to the base station 112 or cell 116. In response todetermining that the mitigation action to throttle (e.g., partiallyblock) the communication device (e.g., communication device 104) is tobe performed, the connection manager component 222 can generatethrottling instructions and can communicate the throttling instructionsto the base station 112 or cell 116. In response to the throttlinginstructions, the base station 112 or cell 116 can throttle theexcessive signaling communication device (e.g., communication device104) to block at least a desired portion (e.g., 50%, 60%, 70%, 80%, orother desired portion greater or less than 80%) of the attempts of theexcessive signaling communication device to attach to, connect to, orcommunicate with the base station 112 or cell 116 (or other basestations or cells, such as other base stations or cells associated withthe RAN 110).

For instance, with regard to blocking or disconnecting of an excessivesignaling communication device (e.g., communication device 104) by orfrom the base station 112 or cell 116, even though the SMC 128 does notknow the permanent device or subscriber identifiers (e.g., IMEI, IMSI)associated with the excessive signaling communication device, thedetector component 220 has identified the communication signature of theexcessive signaling communication device. To facilitate blocking ordisconnecting the excessive signaling communication device (e.g.,communication device 104), the connection manager component 222 caninstruct the RAN 110, base station 112, and/or cell 116 to block ordisconnect all or some (e.g., a desired portion or percentage of)communication devices that have a communication signature that is sameas or substantially similar to the communication signature identifiedfor the excessive signaling communication device (e.g., communicationdevice 104), which will, or at least very likely will, result in theblocking or disconnecting of the excessive signaling communicationdevice (e.g., communication device 104) by or from the base station 112or cell 116. For example, if the excessive signaling communicationdevice (e.g., communication device 104) has a particular calculatedparameter value, a particular communication condition value, or aparticular set of communication condition values, the connection managercomponent 222 can instruct the RAN 110, base station 112, and/or cell116 to block or disconnect all or some communication devices (e.g.,communication device 104) that have a calculated parameter value thatfalls in a range of calculated parameter values that can be determinedbased at least in part on, and can comprise, the particular calculatedparameter value; block or disconnect all or some communication devices(e.g., communication device 104) that have a communication conditionvalue that falls in a range of communication condition values that canbe determined based at least in part on, and can comprise, theparticular communication condition value; or block or disconnect all orsome communication devices (e.g., communication device 104) that have aparticular set of communication condition values where the respectivecommunication condition values in the set fall in respective ranges ofcommunication condition values that can be determined based at least inpart on, and can comprise, the particular set of communication conditionvalues. The connection manager component 222 can thereby effectivelyblock the excessive signaling communication device (e.g., communicationdevice 104) without having to block benign acting (e.g., non-aggressiveor non-malicious) communication devices (e.g., communication devices 106or 108), which can have communication signatures that can be differentfrom the communication signature of the excessive signalingcommunication device (e.g., communication device 104).

In some embodiments, the SMC 128 can comprise a communicator component224 can communicate (e.g., transmit and/or receive) information,including information relating to cells, signal measurement data, alertsignals, detection of anomalous conditions, communication conditionsassociated with communication devices, configuration parametersassociated with communication devices, mitigation or other actions,statistics, metadata, or other desired information relating tomanagement of communications and the communication network 102. Forinstance, the communicator component 224 can receive informationrelating to signaling associated with cells, communication conditionsassociated with communication devices, and/or configuration parametersassociated with communication devices from cells, associated basestations, or associated RANs. The communicator component 224 also cantransmit information relating to alert signals to communication devicesor interface components associated with users, and/or informationrelating to mitigation actions (e.g., blocking or throttling actions) orother desired actions (e.g., response actions) to RANs, base stations,or cells.

In certain embodiments, the SMC 128 can comprise an operations managercomponent 226 that can control (e.g., manage) operations associated withthe SMC 128. For example, the operations manager component 226 canfacilitate generating instructions to have components of the SMC 128perform operations, and can communicate respective instructions torespective components (e.g., NN component 130, feature reformercomponent 132, alert component 218, detector component 220, connectionmanager component 222, communicator component 224, processor component228, data store 230, or other component) of the SMC 128 to facilitateperformance of operations by the respective components of the SMC 128based at least in part on the instructions, in accordance with thedefined communication management or network security criteria, andcommunication management or network security algorithms (e.g., AI, NN,or machine learning algorithms, NN selection algorithms, clusterassignment algorithms, anomalous condition detection algorithms,aggressive or malicious event detection algorithms, connectionmanagement algorithms, parsing algorithms, filtering algorithms, orother algorithm, as disclosed, defined, recited, or indicated herein bythe methods, systems, and techniques described herein). The operationsmanager component 226 also can facilitate controlling data flow betweenthe respective components of the SMC 128 and controlling data flowbetween the SMC 128 and another component(s) or device(s) (e.g., acommunication device, a RAN, a base station or other network componentor device of the communication network, data sources, or applications)associated with (e.g., connected to) the SMC 128.

The SMC 128 also can include a processor component 228 that can work inconjunction with the other components (e.g., NN component 130, featurereformer component 132, alert component 218, detector component 220,connection manager component 222, communicator component 224, operationsmanager component 226, data store 230, or other component) to facilitateperforming the various functions of the SMC 128. The processor component228 can employ one or more processors, microprocessors, or controllersthat can process data, such as information relating to cells, cellclusters, cell or base station classification information,characteristics associated with cells or cell clusters, the cell clusterrepository, NNs, signal measurement data, vectors relating to signalmeasurement data, feature reforming of data, FFTs, truncation of data,anomalous conditions associated with cells, threshold values, alertsignals, communication devices, communication conditions associated withcommunication devices, configuration parameters associated withcommunication devices, device reputation information associated withcommunication devices, characteristics associated with communicationdevices or groups of communication devices, identifiers orauthentication credentials associated with communication devices,network conditions, metadata, messages, data parsing, data filtering,aggressive or malicious events, aggressive or malicious eventdeterminations, false positive determinations, connection managementdeterminations, parameters, traffic flows, policies, definedcommunication management criteria, defined network security criteria,algorithms (e.g., AI, NN, or machine learning algorithms, NN selectionalgorithms, clustering algorithms, anomalous condition detectionalgorithms, aggressive or malicious event detection algorithms,connection management algorithms, parsing algorithms, filteringalgorithms, or other algorithm), protocols, interfaces, tools, and/orother information, to facilitate operation of the SMC 128, as more fullydisclosed herein, and control data flow between the SMC 128 and othercomponents (e.g., a communication device, a RAN, a base station or othernetwork component or device of the communication network, data sources,applications) associated with the SMC 128.

The data store 230 can store data structures (e.g., user data,metadata), code structure(s) (e.g., modules, objects, hashes, classes,procedures) or instructions, information relating to cells, cellclusters, cell or base station classification information,characteristics associated with cells or cell clusters, the cell clusterrepository, NNs, signal measurement data, vectors relating to signalmeasurement data, feature reforming of data, FFTs, truncation of data,anomalous conditions associated with cells, threshold values, alertsignals, communication devices, communication conditions associated withcommunication devices, configuration parameters associated withcommunication devices, device reputation information associated withcommunication devices, characteristics associated with communicationdevices or groups of communication devices, identifiers orauthentication credentials associated with communication devices,network conditions, metadata, messages, data parsing, data filtering,aggressive or malicious events, aggressive or malicious eventdeterminations, false positive determinations, connection managementdeterminations, parameters, traffic flows, policies, definedcommunication management criteria, defined network security criteria,algorithms (e.g., AI, NN, or machine learning algorithms, NN selectionalgorithms, clustering algorithms, anomalous condition detectionalgorithms, aggressive or malicious event detection algorithms,connection management algorithms, parsing algorithms, filteringalgorithms, or other algorithm), protocols, interfaces, tools, and/orother information, to facilitate controlling operations associated withthe SMC 128. In some embodiments, the cell cluster repository 134 can bestored in the data store 230. In an aspect, the processor component 228can be functionally coupled (e.g., through a memory bus) to the datastore 230 in order to store and retrieve information desired to operateand/or confer functionality, at least in part, to the NN component 130,feature reformer component 132, alert component 218, detector component220, connection manager component 222, communicator component 224,operations manager component 226, processor component 228, data store230, or other component, and/or substantially any other operationalaspects of the SMC 128.

Described herein are systems, methods, articles of manufacture, andother embodiments or implementations that can facilitate detecting andmitigating malicious events against a RAN of a communication network,and managing connection of communication devices to the RAN, as morefully described herein. The detecting and mitigating malicious eventsagainst a RAN of a communication network, and managing connection ofcommunication devices to the RAN, and/or other features of the disclosedsubject matter, can be implemented in connection with any type of devicewith a connection to, or attempting to connect to, the communicationnetwork (e.g., a wireless or mobile device, a computer, a handhelddevice, etc.), any Internet of things (IoT) device (e.g., healthmonitoring device, toaster, coffee maker, blinds, music players,speakers, etc.), and/or any connected vehicles (e.g., cars, airplanes,space rockets, and/or other at least partially automated vehicles (e.g.,drones)). In some embodiments, the non-limiting term user equipment (UE)is used. It can refer to any type of wireless device that communicateswith a radio network node in a cellular or mobile communication system.Examples of UE can be a target device, device to device (D2D) UE,machine type UE or UE capable of machine to machine (M2M) communication,PDA, Tablet, mobile terminals, smart phone, Laptop Embedded Equipped(LEE), laptop mounted equipment (LME), USB dongles, etc. Note that theterms element, elements, and antenna ports can be interchangeably usedbut carry the same meaning in this disclosure. The embodiments areapplicable to single carrier as well as to Multi-Carrier (MC) or CarrierAggregation (CA) operation of the UE. The term Carrier Aggregation (CA)is also called (e.g., interchangeably called) “multi-carrier system,”“multi-cell operation,” “multi-carrier operation,” “multi-carrier”transmission and/or reception.

In some embodiments, the non-limiting term radio network node or simplynetwork node is used. It can refer to any type of network node thatserves one or more UEs and/or that is coupled to other network nodes ornetwork elements or any radio node from where the one or more UEsreceive a signal. Examples of radio network nodes are Node B, BaseStation (BS), Multi-Standard Radio (MSR) node such as MSR BS, eNode B,network controller, Radio Network Controller (RNC), Base StationController (BSC), relay, donor node controlling relay, Base TransceiverStation (BTS), Access Point (AP), transmission points, transmissionnodes, RRU, RRH, nodes in Distributed Antenna System (DAS) etc.

Cloud Radio Access Networks (RAN) can enable the implementation ofconcepts such as software-defined network (SDN) and network functionvirtualization (NFV) in 5G networks. This disclosure can facilitate ageneric channel state information framework design for a 5G network.Certain embodiments of this disclosure can comprise an SDN controllercomponent that can control routing of traffic within the network andbetween the network and traffic destinations. The SDN controllercomponent can be merged with the 5G network architecture to enableservice deliveries via open Application Programming Interfaces (APIs)and move the network core towards an all Internet Protocol (IP), cloudbased, and software driven telecommunications network. The SDNcontroller component can work with, or take the place of, Policy andCharging Rules Function (PCRF) network elements so that policies such asquality of service and traffic management and routing can besynchronized and managed end to end.

To meet the huge demand for data centric applications, 4G standards canbe applied to 5G, also called New Radio (NR) access. 5G networks cancomprise the following: data rates of several tens of megabits persecond supported for tens of thousands of users; 1 gigabit per secondcan be offered simultaneously (or concurrently) to tens of workers onthe same office floor; several hundreds of thousands of simultaneous (orconcurrent) connections can be supported for massive sensor deployments;spectral efficiency can be enhanced compared to 4G; improved coverage;enhanced signaling efficiency; and reduced latency compared to LTE. Inmulticarrier system such as OFDM, each subcarrier can occupy bandwidth(e.g., subcarrier spacing). If the carriers use the same bandwidthspacing, then it can be considered a single numerology. However, if thecarriers occupy different bandwidth and/or spacing, then it can beconsidered a multiple numerology.

Referring now to FIG. 9, depicted is an example block diagram of anexample communication device 900 (e.g., wireless or mobile phone,electronic pad or tablet, electronic eyewear, electronic watch, or otherelectronic bodywear, IoT device, or other type of communication device)operable to engage in a system architecture that facilitates wirelesscommunications according to one or more embodiments described herein.Although a communication device is illustrated herein, it will beunderstood that other devices can be a communication device, and thatthe communication device is merely illustrated to provide context forthe embodiments of the various embodiments described herein. Thefollowing discussion is intended to provide a brief, general descriptionof an example of a suitable environment in which the various embodimentscan be implemented. While the description includes a general context ofcomputer-executable instructions embodied on a machine-readable storagemedium, those skilled in the art will recognize that the disclosedsubject matter also can be implemented in combination with other programmodules and/or as a combination of hardware and software.

Generally, applications (e.g., program modules) can include routines,programs, components, data structures, etc., that perform particulartasks or implement particular abstract data types. Moreover, thoseskilled in the art will appreciate that the methods described herein canbe practiced with other system configurations, includingsingle-processor or multiprocessor systems, minicomputers, mainframecomputers, as well as personal computers, hand-held computing devices,microprocessor-based or programmable consumer electronics, and the like,each of which can be operatively coupled to one or more associateddevices.

A computing device can typically include a variety of machine-readablemedia. Machine-readable media can be any available media that can beaccessed by the computer and includes both volatile and non-volatilemedia, removable and non-removable media. By way of example and notlimitation, computer-readable media can comprise computer storage mediaand communication media. Computer storage media can include volatileand/or non-volatile media, removable and/or non-removable mediaimplemented in any method or technology for storage of information, suchas computer-readable instructions, data structures, program modules, orother data. Computer storage media can include, but is not limited to,RAM, ROM, EEPROM, flash memory or other memory technology, solid statedrive (SSD) or other solid-state storage technology, Compact Disk ReadOnly Memory (CD ROM), digital video disk (DVD), Blu-ray disk, or otheroptical disk storage, magnetic cassettes, magnetic tape, magnetic diskstorage or other magnetic storage devices, or any other medium which canbe used to store the desired information and which can be accessed bythe computer. In this regard, the terms “tangible” or “non-transitory”herein as applied to storage, memory or computer-readable media, are tobe understood to exclude only propagating transitory signals per se asmodifiers and do not relinquish rights to all standard storage, memoryor computer-readable media that are not only propagating transitorysignals per se.

Communication media typically embodies computer-readable instructions,data structures, program modules, or other data in a modulated datasignal such as a carrier wave or other transport mechanism, and includesany information delivery media. The term “modulated data signal” means asignal that has one or more of its characteristics set or changed insuch a manner as to encode information in the signal. By way of example,and not limitation, communication media includes wired media such as awired network or direct-wired connection, and wireless media such asacoustic, RF, infrared and other wireless media. Combinations of the anyof the above should also be included within the scope ofcomputer-readable media.

The communication device 900 can include a processor 902 for controllingand processing all onboard operations and functions. A memory 904interfaces to the processor 902 for storage of data and one or moreapplications 906 (e.g., a video player software, user feedback componentsoftware, etc.). Other applications can include voice recognition ofpredetermined voice commands that facilitate initiation of the userfeedback signals. The applications 906 can be stored in the memory 904and/or in a firmware 908, and executed by the processor 902 from eitheror both the memory 904 or/and the firmware 908. The firmware 908 canalso store startup code for execution in initializing the communicationdevice 900. A communication component 910 interfaces to the processor902 to facilitate wired/wireless communication with external systems,e.g., cellular networks, VoIP networks, and so on. Here, thecommunication component 910 can also include a suitable cellulartransceiver 811 (e.g., a GSM transceiver) and/or an unlicensedtransceiver 813 (e.g., Wi-Fi, WiMax) for corresponding signalcommunications. The communication device 900 can be a device such as acellular telephone, a PDA with mobile communications capabilities, andmessaging-centric devices. The communication component 910 alsofacilitates communications reception from terrestrial radio networks(e.g., broadcast), digital satellite radio networks, and Internet-basedradio services networks.

The communication device 900 includes a display 912 for displaying text,images, video, telephony functions (e.g., a Caller ID function), setupfunctions, and for user input. For example, the display 912 can also bereferred to as a “screen” that can accommodate the presentation ofmultimedia content (e.g., music metadata, messages, wallpaper, graphics,etc.). The display 912 can also display videos and can facilitate thegeneration, editing and sharing of video quotes. A serial I/O interface914 is provided in communication with the processor 902 to facilitatewired and/or wireless serial communications (e.g., USB, and/or IEEE1394) through a hardwire connection, and other serial input devices(e.g., a keyboard, keypad, and mouse). This supports updating andtroubleshooting the communication device 900, for example. Audiocapabilities are provided with an audio I/O component 916, which caninclude a speaker for the output of audio signals related to, forexample, indication that the user pressed the proper key or keycombination to initiate the user feedback signal. The audio I/Ocomponent 916 also facilitates the input of audio signals through amicrophone to record data and/or telephony voice data, and for inputtingvoice signals for telephone conversations.

The communication device 900 can include a slot interface 918 foraccommodating a SIC (Subscriber Identity Component) in the form factorof a card Subscriber Identity Module (SIM) or universal SIM 920, andinterfacing the SIM card 920 with the processor 902. However, it is tobe appreciated that the SIM card 920 can be manufactured into thecommunication device 900, and updated by downloading data and software.

The communication device 900 can process IP data traffic through thecommunication component 910 to accommodate IP traffic from an IP networksuch as, for example, the Internet, a corporate intranet, a homenetwork, a person area network, etc., through an ISP or broadband cableprovider. Thus, VoIP traffic can be utilized by the communication device900 and IP-based multimedia content can be received in either an encodedor a decoded format.

A video processing component 922 (e.g., a camera) can be provided fordecoding encoded multimedia content. The video processing component 922can aid in facilitating the generation, editing, and sharing of videoquotes. The communication device 900 also includes a power source 924 inthe form of batteries and/or an AC power subsystem, which power source924 can interface to an external power system or charging equipment (notshown) by a power 110 component 926.

The communication device 900 can also include a video component 930 forprocessing video content received and, for recording and transmittingvideo content. For example, the video component 930 can facilitate thegeneration, editing and sharing of video quotes. A location trackingcomponent 932 facilitates geographically locating the communicationdevice 900. As described hereinabove, this can occur when the userinitiates the feedback signal automatically or manually. A user inputcomponent 934 facilitates the user initiating the quality feedbacksignal. The user input component 934 can also facilitate the generation,editing and sharing of video quotes. The user input component 934 caninclude such conventional input device technologies such as a keypad,keyboard, mouse, stylus pen, and/or touch screen, for example.

Referring again to the applications 906, a hysteresis component 936facilitates the analysis and processing of hysteresis data, which isutilized to determine when to associate with the access point. Asoftware trigger component 938 can be provided that facilitatestriggering of the hysteresis component 936 when the Wi-Fi transceiver913 detects the beacon of the access point. A SIP client 940 enables thecommunication device 900 to support SIP protocols and register thesubscriber with the SIP registrar server. The applications 906 can alsoinclude a client 942 that provides at least the capability of discovery,play and store of multimedia content, for example, music.

The communication device 900, as indicated above related to thecommunication component 910, includes an indoor network radiotransceiver 913 (e.g., Wi-Fi transceiver). This function supports theindoor radio link, such as IEEE 802.11, for the dual-mode GSM device(e.g., communication device 900). The communication device 900 canaccommodate at least satellite radio services through a device (e.g.,handset device) that can combine wireless voice and digital radiochipsets into a single device (e.g., single handheld device).

FIG. 10 illustrates a block diagram of an example AP 1000 (e.g., macrobase station, femto AP, pico AP, Wi-Fi AP, Wi-Fi-direct AP, or othertype of AP), in accordance with various aspects and embodiments of thedisclosed subject matter. The AP 1000 can receive and transmit signal(s)from and to wireless devices like access points (e.g., base stations,femtocells, picocells, or other type of access point), access terminals(e.g., UEs), wireless ports and routers, and the like, through a set ofantennas 10691-1069R. In an aspect, the antennas 10691-1069R are a partof a communication platform 1002, which comprises electronic componentsand associated circuitry that can provide for processing andmanipulation of received signal(s) and signal(s) to be transmitted. Inan aspect, the communication platform 1002 can include areceiver/transmitter 1004 that can convert signal from analog to digitalupon reception, and from digital to analog upon transmission. Inaddition, receiver/transmitter 1004 can divide a single data stream intomultiple, parallel data streams, or perform the reciprocal operation.

In an aspect, coupled to receiver/transmitter 1004 can be amultiplexer/demultiplexer (mux/demux) 1006 that can facilitatemanipulation of signal in time and frequency space. The mux/demux 1006can multiplex information (e.g., data/traffic and control/signaling)according to various multiplexing schemes such as, for example, timedivision multiplexing (TDM), frequency division multiplexing (FDM),orthogonal frequency division multiplexing (OFDM), code divisionmultiplexing (CDM), space division multiplexing (SDM), etc. In addition,mux/demux component 1006 can scramble and spread information (e.g.,codes) according to substantially any code known in the art, e.g.,Hadamard-Walsh codes, Baker codes, Kasami codes, polyphase codes, and soon. A modulator/demodulator (mod/demod) 1008 also can be part of thecommunication platform 1002, and can modulate information according tomultiple modulation techniques, such as frequency modulation, amplitudemodulation (e.g., M-ary quadrature amplitude modulation (QAM), with M apositive integer), phase-shift keying (PSK), and the like.

The AP 1000 also can comprise a processor(s) 1010 that can be configuredto confer and/or facilitate providing functionality, at least partially,to substantially any electronic component in or associated with the AP1000. For instance, the processor(s) 1010 can facilitate operations ondata (e.g., symbols, bits, or chips) for multiplexing/demultiplexing,modulation/demodulation, such as effecting direct and inverse fastFourier transforms, selection of modulation rates, selection of datapacket formats, inter-packet times, etc.

In another aspect, the AP 1000 can include a data store 1012 that canstore data structures; code instructions; rate coding information;information relating to measurement of radio link quality or receptionof information related thereto; information relating to communicationconditions (e.g., SINR, implicit NACK rate, RSRP, RSRQ, CQI, and/orother wireless communications metrics or parameters) associated withcommunication devices, the group of parameters (e.g., resource blockparameter, MCS parameter, packet repetition parameter, and/or otherdesired parameter), the respective threshold values associated with therespective parameters, ACK/NACK-related information (e.g., ACK/NACKstatus information), time-related information, metadata, communicationdevices, policies and rules, users, applications, services,communication management criteria, traffic flows, signaling, algorithms(e.g., communication management algorithm(s), mapping algorithm(s), orother algorithm), protocols, interfaces, tools, and/or otherinformation, etc.; white list information, information relating tomanaging or maintaining the white list; system or device informationlike policies and specifications; code sequences for scrambling;spreading and pilot transmission; floor plan configuration; access pointdeployment and frequency plans; scheduling policies; and so on. Theprocessor(s) 1010 can be coupled to the data store 1012 in order tostore and retrieve information (e.g., information, such as algorithms,relating to multiplexing/demultiplexing or modulation/demodulation;information relating to radio link levels; information relating tocommunication conditions (e.g., SINR, implicit NACK rate, RSRP, RSRQ,CQI, and/or other wireless communications metrics or parameters)associated with communication devices, the group of parameters (e.g.,resource block parameter, MCS parameter, packet repetition parameter,and/or other desired parameter), the respective threshold valuesassociated with the respective parameters, ACK/NACK-related information(e.g., ACK/NACK status information), time-related information, metadata,communication devices, policies and rules, users, applications,services, communication management criteria, traffic flows, signaling,algorithms (e.g., communication management algorithm(s), mappingalgorithm(s), or other algorithm), protocols, interfaces, tools, and/orother information) desired to operate and/or confer functionality to thecommunication platform 1002 and/or other operational components of AP1000.

The aforementioned systems and/or devices have been described withrespect to interaction between several components. It should beappreciated that such systems and components can include thosecomponents or sub-components specified therein, some of the specifiedcomponents or sub-components, and/or additional components.Sub-components could also be implemented as components communicativelycoupled to other components rather than included within parentcomponents. Further yet, one or more components and/or sub-componentsmay be combined into a single component providing aggregatefunctionality. The components may also interact with one or more othercomponents not specifically described herein for the sake of brevity,but known by those of skill in the art.

In view of the example systems and/or devices described herein, examplemethods that can be implemented in accordance with the disclosed subjectmatter can be further appreciated with reference to flowcharts in FIGS.11-15. For purposes of simplicity of explanation, example methodsdisclosed herein are presented and described as a series of acts;however, it is to be understood and appreciated that the disclosedsubject matter is not limited by the order of acts, as some acts mayoccur in different orders and/or concurrently with other acts from thatshown and described herein. For example, a method disclosed herein couldalternatively be represented as a series of interrelated states orevents, such as in a state diagram. Moreover, interaction diagram(s) mayrepresent methods in accordance with the disclosed subject matter whendisparate entities enact disparate portions of the methods. Furthermore,not all illustrated acts may be required to implement a method inaccordance with the subject specification. It should be furtherappreciated that the methods disclosed throughout the subjectspecification are capable of being stored on an article of manufactureto facilitate transporting and transferring such methods to computersfor execution by a processor or for storage in a memory.

FIG. 11 illustrates a flow chart of an example method 1100 that cancluster cells according to their normal signaling behavior and detectabnormal behavior associated with a cell to facilitate detectingaggressive signaling by communication devices against the cell, inaccordance with various aspects and embodiments of the disclosed subjectmatter. The method 1100 can be employed by, for example, a systemcomprising the SMC, a processor component (e.g., of or associated withthe SMC), and/or a data store (e.g., of or associated with the SMC).

At 1102, a NN of a group of NNs to utilize to determine a representationof a communication network, comprising a group of cells, can bedetermined based at least in part on the results of a first analysis offirst signal measurement data that can be representative of first signalmeasurements of first signals associated with the group of cells. Thecommunication network (e.g., wireless, cellular, and/or core network)can comprise the group of cells, wherein respective cells can beassociated with respective base stations of the communication network.The SMC (e.g., employing a NN) can determine the NN of the group of NNsto utilize to determine the representation (e.g., signaling behaviorrepresentation) of the communication network based at least in part onthe results of the first analysis of the first signal measurement dataassociated with the group of cells, as more fully described herein. Forexample, the SMC (e.g., employing a NN) can determine which NN, of thegroup of NNs, can most accurately determine the representation of thecommunication network based at least in part on the results of the firstanalysis, as more fully described herein. The first signal measurementdata can comprise, for example, data regarding a first signalmeasurements time series associated with the group of cells, whereinrespective portions of such data can be associated with respective cellsof the group of cells. In some embodiments, the SMC can perform featurereforming on the first signal measurement data to reduce the vectordimensionality of the first signal measurement data to facilitateenhancing encoding and decoding by the NNs of the group of NNs, as morefully described herein.

At 1104, respective cells of the group of cells can be clustered intorespective clusters of cells by the system, using the NN, based at leastin part on the results of a second analysis of second signal measurementdata that can be representative of second signal measurements of secondsignals associated with the group of cells, wherein the respectiveclusters comprise a cluster of cells. The NN can cluster the respectivecells of the group of cells into the respective clusters of cells basedat least in part on the results of the second analysis of the secondsignal measurement data associated with the group of cells. The secondsignal measurement data can comprise, for example, data regarding asecond signal measurements time series associated with the group ofcells, wherein respective portions of such data can be associated withrespective cells of the group of cells. The second signal measurementdata can be the same as or different from the first signal measurementdata.

In some embodiments, if the second signal measurement data is differentfrom the first signal measurement data, the SMC can perform featurereforming on the second signal measurement data to reduce the vectordimensionality of the second signal measurement data to facilitateenhancing encoding and decoding by the NN, as more fully describedherein. In certain embodiments, if the second signal measurement data isthe same as the first signal measurement data, the SMC can bypassperforming feature reforming again on this signal measurement data, andcan reuse the feature reforming results on the first signal measurementdata (which, in this instance, also is the second signal measurementdata) to reduce the vector dimensionality of the first signalmeasurement data to facilitate enhancing encoding (e.g., encoding of thefrequency feature reduced dimensionality vectors relating to the firstsignal measurement data) by the NN.

As part of the second analysis, the NN can encode the reduced number ofvectors associated with (e.g., representative of) the second signalmeasurement data to further reduce the vector dimensionality associatedwith (e.g., representative of) the second signal measurement data. Forexample, the NN can encode the frequency feature reduced dimensionalityvectors (e.g., 24×1 vectors) to further reduce the vector dimensionalityto a 2×1 vector for each cell, wherein, for each cell, the 2×1 vectorassociated with such cell can be representative of the portion of thesecond signal measurement data that is associated with (e.g., relatesto) that cell.

The NN can determine (e.g., calculate) relative proximities (e.g.,distances or numerical differences) between respective vectors (e.g.,respective 2×1 vectors) associated with the respective cells based atleast in part on the results of analyzing the respective vectors (e.g.,analyzing the respective values (e.g., vector values) of the respectivevalues). The NN can cluster (e.g., iteratively cluster) the respectivecells into the respective clusters of cells based at least in part onthe relative proximities (e.g., relative distances or differences)between the respective vectors associated with the respective cells, asmore fully described herein. The SMC or NN can store informationrelating to the clusters of cells in the cell cluster repository.

At 1106, a determination can be made, by the NN, regarding whether adefined abnormal condition associated with a cell of the cluster ofcells has occurred based at least in part on the results of a thirdanalysis of third signal measurement data that can be representative ofthird signal measurements of third signals associated with the group ofcells and based at least in part on defined network security criteriathat defines what constitutes the defined abnormal condition. The thirdsignal measurement data can comprise, for example, data regarding athird signal measurements time series associated with the group ofcells, wherein respective portions of such data can be associated withrespective cells of the group of cells. As part of the third analysis ofthe third signal measurement data, the SMC can perform feature reformingon the third signal measurement data to reduce the vector dimensionalityof the third signal measurement data to facilitate enhancing encoding bythe NN, as more fully described herein.

As part of the third analysis, the NN can encode the frequency featurereduced dimensionality vectors associated with (e.g., representative of)the third signal measurement data to further reduce the number ofvectors associated with (e.g., representative of) the third signalmeasurement data. For example, the NN can encode the frequency featurereduced dimensionality vectors (e.g., 24×1 vectors) to further reducethe dimensionality of those vectors to a 2×1 vector for each cell,wherein, for each cell, the 2×1 vector associated with such cell can berepresentative of the portion of the third signal measurement data thatis associated with (e.g., relates to) that cell.

The NN can classify the respective cells based at least in part on therespective encoded vectors associated with the respective cells andinformation relating to the respective clusters of cells, which can beretrieved from the cell cluster repository. The NN can determine whetherthe defined abnormal condition associated with the cell has occurredbased at least in part on the classification of the cell, in accordancewith the defined network security criteria. For example, the NN candetermine whether the encoded vector (e.g., 2×1 vector) associated withthe cell is outside of a vector range associated with the cluster ofcells with which the cell belongs. If the NN determines that the encodedvector associated with the cell is inside of (e.g., within) the vectorrange associated with the cluster of cells, the NN can determine thatthere is no defined abnormal condition associated with the cell at thistime, in accordance with the defined network security criteria. If,instead, the NN determines that the encoded vector (e.g., 2×1 vector)associated with the cell is outside of the vector range associated withthe cluster of cells, the NN can determine that there is a definedabnormal condition associated with the cell, in accordance with thedefined network security criteria. If the defined abnormal condition hasbeen detected, the SMC or NN can generate an alert (e.g., alert ornotification message) and can present (e.g., display or communicate) thealert to a user (e.g., a communication device or interface associatedwith the user), the connection manager component, or another componentof or associated with the SMC to notify regarding the detection of thedefined abnormal condition associated with the cell to facilitateperforming a desired (e.g., appropriate, suitable, or optimal) responseaction (e.g., mitigation action or other action) to the defined abnormalcondition, such as more fully described herein.

FIG. 12 depicts a flow chart of an example method 1200 that can performfeature reforming on signal measurement data associated with cells tofacilitate reducing the vector dimensionality of the signal measurementdata to facilitate enhancing encoding and/or decoding by NNs tofacilitate detection of abnormal conditions associated with cells, inaccordance with various aspects and embodiments of the disclosed subjectmatter. The method 1200 can be employed by, for example, a systemcomprising the SMC, a processor component (e.g., of or associated withthe SMC), and/or a data store (e.g., of or associated with the SMC).

At 1202, signal measurement data (e.g., respective signal measurementstime series) associated with a group of cells can be generated. The SMCcan receive raw signal measurement data from the cells of the group ofcells of a communication network (e.g., wireless, core, and/or cellularnetwork). The SMC can generate (e.g., form) the signal measurement databased at least in part on the result of analyzing the raw signalmeasurement data, wherein the signal measurement data can comprise, forexample, data regarding a signal measurements time series associatedwith the group of cells, and wherein respective portions of such datacan be associated with respective cells of the group of cells. Forinstance, the SMC can generate a respective signal measurements timeseries for each cell of the group of cells. The length of time of asignal measurements time series can be virtually any desired length oftime (e.g., a day, a week, a month, a year, or other desired length oftime) and can have a desired granularity with regard to the timing ofmeasurements of the signals (e.g., measurements every minute, every fiveminutes, every ten minutes, every fifteen minutes, every hour, everythree hours, or another desired granularity for the signalingmeasurements). The signal measurement data can have a timedimensionality (e.g., 96×1 time dimensionality, 144×1 timedimensionality, or other time dimensionality) that can be based at leastin part on the signaling measurement granularity and the time length ofmeasurements of the signal measurements time series.

At 1204, for each cell, an FFT of a signal measurements time series ofthe cell can be calculated to generate a vector having a vectordimensionality that can correspond to the dimensionality of the signalmeasurements time series. For each cell of the group of cells, the SMCcan determine or calculate the FFT of the signal measurements timeseries of the cell to generate a vector having a vector dimensionalitythat can correspond to the dimensionality of the signal measurementstime series. For example, if the signal measurements time seriesassociated with a cell has a dimensionality of 96×1, the SMC candetermine or calculate the FFT of the signal measurements time series ofthe cell to generate a corresponding 96×1 vector that can berepresentative of (e.g., can correspond to) the signal measurements timeseries of the cell.

At 1206, for each cell, a desired portion of the magnitudes of theabsolute value of the FFT at the high-frequency bins can be truncated togenerate a frequency feature reduced dimensionality vector that can havea reduced vector dimensionality in relation to (e.g., as compared to)the vector of the cell. The SMC can truncate the desired portion (e.g.,half or more than half) of the magnitudes of the absolute value of theFFT (e.g., |FFT|) at the high-frequency bins to generate a frequencyfeature dimensionality vector that can have a desirably reduced vectordimensionality (e.g., half or less than half of the vectordimensionality) in relation to the vector of the cell. For example, ifthe cell is associated with a 96×1 vector, the SMC can truncate half ofthe magnitudes of the absolute value of the FFT at the high-frequencybins to generate a frequency feature 48×1 vector that can have adesirably reduced (e.g., to half of the) vector dimensionality inrelation to the 96×1 vector of the cell. As another example, if the cellis associated with a 96×1 vector, the SMC can truncate more than half ofthe magnitudes of the absolute value of the FFT at the high-frequencybins to generate a frequency feature 24×1 vector that can have adesirably reduced (e.g., to less than half of the) vector dimensionalityin relation to the 96×1 vector of the cell.

In accordance with various embodiments, the SMC, employing a desiredNN(s), can utilize the respective frequency feature reduceddimensionality vectors associated with the respective cells tofacilitate NN selection, cluster assignment to facilitate clusteringcells into clusters, and/or detection of outlier cells (e.g., cells thatare experiencing abnormal or excessive signaling from communicationdevices), as more fully described herein.

FIG. 13 illustrates a flow chart of an example method 1300 that candetermine and select a desirable NN from a group of NNs where thedesired neural network can be employed to facilitate detection ofabnormal conditions associated with cells, in accordance with variousaspects and embodiments of the disclosed subject matter. The method 1300can be employed by, for example, a system comprising the SMC, aprocessor component (e.g., of or associated with the SMC), and/or a datastore (e.g., of or associated with the SMC).

At 1302, feature reforming can be performed on respective signalmeasurement data associated with respective cells of a communicationnetwork to generate respective frequency feature reduced dimensionalityvectors associated with the respective cells. The SMC can performfeature reforming on the respective signal measurement data associatedwith the respective cells to generate the respective frequency featurereduced dimensionality vectors associated with the respective cells, asmore fully described herein. The respective frequency feature reduceddimensionality vectors can have a desirably smaller or reduced vectordimensionality (e.g., 24×1, 48×1, or other smaller vectordimensionality) than the dimensionality (e.g., 96×1 or other higherdimensionality) of the respective signal measurement data. Therespective frequency feature reduced dimensionality vectors associatedwith the respective cells can be representative of the respective signalmeasurement data associated with respective cells.

At 1304, respective parameters of respective NNs of a group of NNs canbe set. The SMC can determine and/or set the respective parameters ofthe respective NNs of the group of NNs. The respective parameters cancomprise or relate to encoding and decoding of data (e.g., frequencyfeature reduced dimensionality vectors). The respective parameters forthe respective NNs can be different for different NNs. For instance, afirst NN can be configured based at least in part on first parameters, asecond NN can be configured based at least in part on second parameters,a third NN can be configured based at least in part on third parameters,and so on.

At 1306, for each NN, the respective frequency feature reduceddimensionality vectors associated with the respective cells can beencoded to reduce the vector dimensionality of the respective frequencyfeature reduced dimensionality vectors to generate respective encodedreduced dimensionality vectors associated with the respective cells andhaving a desirably smaller vector dimensionality. With regard to eachNN, the NN (e.g., employing an auto encoder) can encode the respectivefrequency feature reduced dimensionality (e.g., 24×1 or 48×1) vectorsassociated with the respective cells to reduce the vector dimensionalityof the respective frequency feature reduced dimensionality vectors togenerate the respective encoded reduced dimensionality (e.g., 2×1)vectors associated with the respective cells and having the desirablysmaller vector dimensionality (e.g., 2×1).

At 1308, for each NN, the respective encoded reduced dimensionalityvectors associated with the respective cells can be decoded to generaterespective decoded vectors associated with the respective cells. Withregard to each NN, the NN (e.g., employing a decoder) can decode therespective encoded reduced dimensionality (e.g., 2×1) vectors associatedwith the respective cells to generate the respective decoded (e.g., 24×1or 48×1) vectors associated with the respective cells. The decodedvectors associated with the cells can have the same dimensionality asthe frequency feature reduced dimensionality vectors associated with thecells.

At 1310, with regard to each NN, the accuracy of the NN in representinga communication network (e.g., core or cellular network) can bedetermined based at least in part on the difference between therespective decoded vectors and the respective frequency feature reduceddimensionality vectors associated with the respective cells. With regardto each NN, the NN can determine (e.g., calculate) the accuracy of theNN in representing the communication network based at least in part on(e.g., as a function of) the difference between the output of the NN andthe input of the NN. Accordingly, with regard to each NN, the NN candetermine the accuracy of the NN in representing the communicationnetwork based at least in part on the difference between the respectivedecoded vectors and the respective frequency feature reduceddimensionality vectors associated with the respective cells.

At 1312, a determination can be made regarding which NN of the group ofNNs is the most accurate in representing the communication network basedat least in part on the results of comparing the respective accuraciesof the respective NNs. The SMC or an NN can compare the respectiveaccuracies of the respective NNs. Based at least in part on the resultsof the comparison, the SMC or NN can determine which NN of the group ofNNs is the most accurate in representing the communication network. Forexample, the SMC or NN can determine which NN has the smallest amount oferror or difference between the respective decoded vectors and therespective frequency feature reduced dimensionality vectors associatedwith the respective cells.

At 1314, the NN having the highest accuracy relative to the other NNs ofthe group of NNs can be selected for use to facilitate detectingabnormal conditions associated with cells. The SMC or an NN can selectthe NN, which is determined to have the highest accuracy (e.g., thesmallest amount of error) relative to the other NNs, for use tofacilitate detecting abnormal conditions associated with cells.

FIG. 14 depicts a flow chart of an example method 1400 that candesirably cluster cells into clusters where the clusters of cells can beused to facilitate detection of abnormal conditions associated withcells, in accordance with various aspects and embodiments of thedisclosed subject matter. The method 1400 can be employed by, forexample, a system comprising the SMC, a processor component (e.g., of orassociated with the SMC), and/or a data store (e.g., of or associatedwith the SMC). The SMC can comprise or be associated with a NN that canbe selected from a group of NNs (e.g., due to being determined to be themost accurate NN) to be used to facilitate clustering cells intoclusters (e.g., assigning cells to clusters) and detection of abnormalconditions associated with cells, as more fully described herein.

At 1402, feature reforming can be performed on respective signalmeasurement data associated with respective cells of a communicationnetwork to generate respective frequency feature reduced dimensionalityvectors associated with the respective cells. The SMC can performfeature reforming on the respective signal measurement data associatedwith the respective cells to generate the respective frequency featurereduced dimensionality vectors associated with the respective cells, asmore fully described herein. The respective frequency feature reduceddimensionality vectors can have a desirably smaller or reduceddimensionality (e.g., 24×1, 48×1, or other smaller vectordimensionality) than the dimensionality (e.g., 96×1 or other higherdimensionality) of the respective signal measurement data. Therespective frequency feature reduced dimensionality vectors associatedwith the respective cells can be representative of the respective signalmeasurement data associated with the respective cells. In someembodiments, if the signal measurement data is the same data that wasused during stage 1 of the multi-stage process to facilitate determiningwhich NN of the group of NNs most accurately is representative of thecommunication network, the SMC can utilize the feature reforming results(e.g., the respective frequency feature reduced dimensionality vectorsassociated with the respective cells) from stage 1, instead ofperforming feature reforming on the same data again.

At 1404, the respective frequency feature reduced dimensionality vectorsassociated with the respective cells can be encoded, by the desired NN,to reduce the vector dimensionality of the respective frequency featurereduced dimensionality vectors to generate respective encoded reduceddimensionality vectors associated with the respective cells and having adesirably smaller vector dimensionality. The desired (e.g., selectedand/or most accurate) NN (e.g., employing an auto encoder) can encodethe respective frequency feature reduced dimensionality (e.g., 24×1 or48×1) vectors associated with the respective cells to reduce the vectordimensionality of the respective frequency feature reduceddimensionality vectors to generate the respective encoded reduceddimensionality (e.g., 2×1) vectors associated with the respective cellsand having the desirably smaller vector dimensionality (e.g., 2×1). Theencoding performed by the NN can be based at least in part on theparameters (e.g., encoding parameters) selected for the NN by the SMC oruser.

At 1406, the relative proximities between the respective encoded reduceddimensionality vectors associated with the respective cells can bedetermined based at least in part on a result of comparing therespective encoded reduced dimensionality vectors to each other. The NNcan determine the relative proximities (e.g., distances or numericaldifferences) between the respective encoded reduced dimensionalityvectors associated with the respective cells based at least in part onthe result of comparing the respective encoded reduced dimensionalityvectors to each other. In some embodiments, the NN can plot or overlaythe respective encoded reduced dimensionality vectors in a 2-D area(e.g., on a 2-D graph) to facilitate determining identifying ordetermining the relative proximities between the respective encodedreduced dimensionality vectors associated with the respective cells.

At 1408, respective cells of the group of cells can be clustered, by theNN, into respective clusters of cells based at least in part on therelative proximities between the respective encoded reduceddimensionality vectors associated with the respective cells. The NN cancluster (e.g., iteratively cluster) the respective cells into therespective clusters of cells based at least in part on the relativeproximities between the respective encoded reduced dimensionalityvectors associated with the respective cells. For instance, the NN caniteratively cluster the respective cells into the respective clusters byidentifying encoded reduced dimensionality vectors associated with cellswhere such vectors are in relative proximity to each other (e.g.,relatively close to each other), as compared to other encoded reduceddimensionality vectors associated with other cells and clustering thosecells together into a small cluster, and merging that smaller cluster ofcells with (an)other smaller cluster(s) of cells that is determined tobe in proximity to the smaller cluster of cells to form a larger clusterof cells, and continuing this iterative clustering process until adesired (e.g., defined) number of clusters of cells are formed.

At 1410, information relating to the clusters of cells can be stored ina cell cluster repository. The SMC or NN can store information relatingto the clusters of cells in the cell cluster repository, which can be,or can be stored in, a data store. The information relating to theclusters of cells can indicate which cells are in which clusters, canidentify or classify respective characteristics of the respective cellclusters and/or the respective cells within the respective cellclusters, and/or other desired information, as more fully describedherein.

FIG. 15 illustrates a flow chart of an example method 1500 that candetect abnormal conditions associated with cells, in accordance withvarious aspects and embodiments of the disclosed subject matter. Themethod 1500 can be employed by, for example, a system comprising theSMC, a processor component (e.g., of or associated with the SMC), and/ora data store (e.g., of or associated with the SMC). The SMC can compriseor be associated with a NN that can be selected from a group of NNs(e.g., due to being determined to be the most accurate NN) to be used tofacilitate detecting abnormal conditions associated with cells.

At 1502, feature reforming can be performed on respective signalmeasurement data associated with respective cells of a communicationnetwork to generate respective frequency feature reduced dimensionalityvectors associated with the respective cells. The SMC can performfeature reforming on the respective signal measurement data associatedwith the respective cells to generate the respective frequency featurereduced dimensionality vectors associated with the respective cells, asmore fully described herein. The respective frequency feature reduceddimensionality vectors can have a desirably smaller or reduced vectordimensionality (e.g., 24×1, 48×1, or other smaller vectordimensionality) than the dimensionality (e.g., 96×1 or other higherdimensionality) of the respective signal measurement data. Therespective frequency feature reduced dimensionality vectors associatedwith the respective cells can be representative of the respective signalmeasurement data associated with the respective cells. The signalmeasurement data can be different signal measurement data than what wasused during stage 1 and stage 2 of the multi-stage process.

At 1504, the respective frequency feature reduced dimensionality vectorsassociated with the respective cells can be encoded, by the desired NN,to reduce the vector dimensionality of the respective frequency featurereduced dimensionality vectors to generate respective encoded reduceddimensionality vectors associated with the respective cells and having adesirably smaller vector dimensionality. The desired (e.g., selectedand/or most accurate) NN (e.g., employing an auto encoder) can encodethe respective frequency feature reduced vector dimensionality (e.g.,24×1 or 48×1) vectors associated with the respective cells to reduce thevector dimensionality of the respective frequency feature reduceddimensionality vectors to generate the respective encoded reduceddimensionality (e.g., 2×1) vectors associated with the respective cellsand having the desirably smaller vector dimensionality (e.g., 2×1). Theencoding performed by the NN can be based at least in part on theparameters (e.g., encoding parameters) selected for the NN by the SMC oruser.

At 1506, for each encoded reduced dimensionality vector associated witha cell, the encoded reduced dimensionality vector associated with thecell can be compared to the defined threshold vector range associatedwith the cluster of cells to which the cell has been assigned. For eachencoded reduced dimensionality vector associated with a cell, thedesired NN can compare the encoded reduced dimensionality vectorassociated with the cell to the defined threshold vector rangeassociated with the cluster of cells to which the cell has been assignedto facilitate determining whether the cell is an outlier with regard toits cell cluster, which can indicate abnormal behavior by the cell, oris operating within the defined threshold vector range associated withthe cell cluster. The defined threshold vector range can be the vectorrange associated with the cell cluster or can be based at least in parton the vector range associated with the cell cluster, in accordance withthe defined network security criteria, as more fully described herein.

At 1508, for each encoded reduced dimensionality vector associated witha cell, a determination can be made regarding whether the encodedreduced dimensionality vector associated with the cell is outside of thedefined threshold vector range associated with the cell cluster to whichthe cell is assigned, based at least in part on the comparison result.For each encoded reduced dimensionality vector associated with a cell,the desired NN can determine whether the encoded reduced dimensionalityvector associated with the cell is outside of the defined thresholdvector range associated with the cell cluster to which the cell isassigned, based at least in part on the comparison result.

For each encoded reduced dimensionality vector associated with a cell,if, at 1508, based at least in part on the comparison result, it isdetermined that the encoded reduced dimensionality vector associatedwith the cell is within the defined threshold vector range associatedwith the cell cluster to which the cell is assigned, at 1510, it can bedetermined that no abnormal condition associated with the cell has beendetected. For each encoded reduced dimensionality vector associated witha cell, if, based at least in part on the comparison result, the desiredNN determines that the encoded reduced dimensionality vector associatedwith the cell is within the defined threshold vector range associatedwith its cell cluster, the NN can determine that no abnormal condition(e.g., no abnormal signaling condition) associated with the cell hasbeen detected (e.g., the signaling associated with the cell is normal).

Referring again to reference numeral 1508, for each encoded reduceddimensionality vector associated with a cell, if, at 1508, based atleast in part on the comparison result, it is determined that theencoded reduced dimensionality vector associated with the cell isoutside of the defined threshold vector range associated with the cellcluster to which the cell is assigned, at 1512, it can be determinedthat a defined abnormal condition associated with the cell has beendetected. For each encoded reduced dimensionality vector associated witha cell, if, based at least in part on the comparison result, the NNdetermines that the encoded reduced dimensionality vector associatedwith the cell is outside of the defined threshold vector rangeassociated with its cell cluster, the NN can determine that the definedabnormal condition (e.g., an abnormal or excessive signaling condition)associated with the cell has been detected.

At 1514, for each cell with regard to which a defined abnormal conditionhas been detected, an alert signal can be presented, wherein the alertsignal can provide an alert or notification regarding the detection ofthe defined abnormal condition associated with the cell. For each cellwith regard to which a defined abnormal condition has been detected, theSMC or NN can generate an alert signal, wherein the alert signal canprovide an alert or notification regarding the detection of the definedabnormal condition associated with the cell. The SMC or NN can present(e.g., display or communicate) the alert signal to a communicationdevice, interface component, detector component, connection managercomponent, RAN, base station, cell, and/or user to facilitate providinga notification regarding the detected abnormal condition associated withthe cell and/or to facilitate initiating a response action (e.g.,mitigation action or other desired action) to respond to and/or mitigatethe detected abnormal condition associated with the cell, as more fullydescribed herein.

In order to provide additional context for various embodiments describedherein, FIG. 16 and the following discussion are intended to provide abrief, general description of a suitable computing environment 1600 inwhich the various embodiments of the embodiments described herein can beimplemented. While the embodiments have been described above in thegeneral context of computer-executable instructions that can run on oneor more computers, those skilled in the art will recognize that theembodiments can be also implemented in combination with other programmodules and/or as a combination of hardware and software.

Generally, program modules include routines, programs, components, datastructures, etc., that perform particular tasks or implement particularabstract data types. Moreover, those skilled in the art will appreciatethat the methods can be practiced with other computer systemconfigurations, including single-processor or multiprocessor computersystems, minicomputers, mainframe computers, Internet of Things (IoT)devices, distributed computing systems, as well as personal computers,hand-held computing devices, microprocessor-based or programmableconsumer electronics, and the like, each of which can be operativelycoupled to one or more associated devices.

The illustrated embodiments of the embodiments herein can be alsopracticed in distributed computing environments where certain tasks areperformed by remote processing devices that are linked through acommunications network. In a distributed computing environment, programmodules can be located in both local and remote memory storage devices.

Computing devices typically include a variety of media, which caninclude computer-readable storage media, machine-readable storage media,and/or communications media, which two terms are used herein differentlyfrom one another as follows. Computer-readable storage media ormachine-readable storage media can be any available storage media thatcan be accessed by the computer and includes both volatile andnonvolatile media, removable and non-removable media. By way of example,and not limitation, computer-readable storage media or machine-readablestorage media can be implemented in connection with any method ortechnology for storage of information such as computer-readable ormachine-readable instructions, program modules, structured data orunstructured data.

Computer-readable storage media can include, but are not limited to,random access memory (RAM), read only memory (ROM), electricallyerasable programmable read only memory (EEPROM), flash memory or othermemory technology, compact disk read only memory (CD-ROM), digitalversatile disk (DVD), Blu-ray disc (BD) or other optical disk storage,magnetic cassettes, magnetic tape, magnetic disk storage or othermagnetic storage devices, solid state drives or other solid statestorage devices, or other tangible and/or non-transitory media which canbe used to store desired information. In this regard, the terms“tangible” or “non-transitory” herein as applied to storage, memory orcomputer-readable media, are to be understood to exclude onlypropagating transitory signals per se as modifiers and do not relinquishrights to all standard storage, memory or computer-readable media thatare not only propagating transitory signals per se.

Computer-readable storage media can be accessed by one or more local orremote computing devices, e.g., via access requests, queries or otherdata retrieval protocols, for a variety of operations with respect tothe information stored by the medium.

Communications media typically embody computer-readable instructions,data structures, program modules or other structured or unstructureddata in a data signal such as a modulated data signal, e.g., a carrierwave or other transport mechanism, and includes any information deliveryor transport media. The term “modulated data signal” or signals refersto a signal that has one or more of its characteristics set or changedin such a manner as to encode information in one or more signals. By wayof example, and not limitation, communication media include wired media,such as a wired network or direct-wired connection, and wireless mediasuch as acoustic, RF, infrared and other wireless media.

With reference again to FIG. 16, the example environment 1600 forimplementing various embodiments of the aspects described hereinincludes a computer 1602, the computer 1602 including a processing unit1604, a system memory 1606 and a system bus 1608. The system bus 1608couples system components including, but not limited to, the systemmemory 1606 to the processing unit 1604. The processing unit 1604 can beany of various commercially available processors. Dual microprocessorsand other multi-processor architectures can also be employed as theprocessing unit 1604.

The system bus 1608 can be any of several types of bus structure thatcan further interconnect to a memory bus (with or without a memorycontroller), a peripheral bus, and a local bus using any of a variety ofcommercially available bus architectures. The system memory 1606includes ROM 1610 and RAM 1612. A basic input/output system (BIOS) canbe stored in a non-volatile memory such as ROM, erasable programmableread only memory (EPROM), EEPROM, which BIOS contains the basic routinesthat help to transfer information between elements within the computer1602, such as during startup. The RAM 1612 can also include a high-speedRAM such as static RAM for caching data.

The computer 1602 further includes an internal hard disk drive (HDD)1614 (e.g., EIDE, SATA), one or more external storage devices 1616(e.g., a magnetic floppy disk drive (FDD) 1616, a memory stick or flashdrive reader, a memory card reader, etc.) and an optical disk drive 1620(e.g., which can read or write from a CD-ROM disc, a DVD, a BD, etc.).While the internal HDD 1614 is illustrated as located within thecomputer 1602, the internal HDD 1614 can also be configured for externaluse in a suitable chassis (not shown). Additionally, while not shown inenvironment 1600, a solid state drive (SSD) could be used in additionto, or in place of, an HDD 1614. The HDD 1614, external storagedevice(s) 1616 and optical disk drive 1620 can be connected to thesystem bus 1608 by an HDD interface 1624, an external storage interface1626 and an optical drive interface 1628, respectively. The interface1624 for external drive implementations can include at least one or bothof Universal Serial Bus (USB) and Institute of Electrical andElectronics Engineers (IEEE) 1394 interface technologies. Other externaldrive connection technologies are within contemplation of theembodiments described herein.

The drives and their associated computer-readable storage media providenonvolatile storage of data, data structures, computer-executableinstructions, and so forth. For the computer 1602, the drives andstorage media accommodate the storage of any data in a suitable digitalformat. Although the description of computer-readable storage mediaabove refers to respective types of storage devices, it should beappreciated by those skilled in the art that other types of storagemedia which are readable by a computer, whether presently existing ordeveloped in the future, could also be used in the example operatingenvironment, and further, that any such storage media can containcomputer-executable instructions for performing the methods describedherein.

A number of program modules can be stored in the drives and RAM 1612,including an operating system 1630, one or more application programs1632, other program modules 1634 and program data 1636. All or portionsof the operating system, applications, modules, and/or data can also becached in the RAM 1612. The systems and methods described herein can beimplemented utilizing various commercially available operating systemsor combinations of operating systems.

Computer 1602 can optionally comprise emulation technologies. Forexample, a hypervisor (not shown) or other intermediary can emulate ahardware environment for operating system 1630, and the emulatedhardware can optionally be different from the hardware illustrated inFIG. 16. In such an embodiment, operating system 1630 can comprise onevirtual machine (VM) of multiple VMs hosted at computer 1602.Furthermore, operating system 1630 can provide runtime environments,such as the Java runtime environment or the .NET framework, forapplications 1632. Runtime environments are consistent executionenvironments that allow applications 1632 to run on any operating systemthat includes the runtime environment. Similarly, operating system 1630can support containers, and applications 1632 can be in the form ofcontainers, which are lightweight, standalone, executable packages ofsoftware that include, e.g., code, runtime, system tools, systemlibraries and settings for an application.

Further, computer 1602 can be enable with a security module, such as atrusted processing module (TPM). For instance, with a TPM, bootcomponents hash next in time boot components, and wait for a match ofresults to secured values, before loading a next boot component. Thisprocess can take place at any layer in the code execution stack ofcomputer 1602, e.g., applied at the application execution level or atthe operating system (OS) kernel level, thereby enabling security at anylevel of code execution.

A user can enter commands and information into the computer 1602 throughone or more wired/wireless input devices, e.g., a keyboard 1638, a touchscreen 1640, and a pointing device, such as a mouse 1642. Other inputdevices (not shown) can include a microphone, an infrared (IR) remotecontrol, a radio frequency (RF) remote control, or other remote control,a joystick, a virtual reality controller and/or virtual reality headset,a game pad, a stylus pen, an image input device, e.g., camera(s), agesture sensor input device, a vision movement sensor input device, anemotion or facial detection device, a biometric input device, e.g.,fingerprint or iris scanner, or the like. These and other input devicesare often connected to the processing unit 1604 through an input deviceinterface 1644 that can be coupled to the system bus 1608, but can beconnected by other interfaces, such as a parallel port, an IEEE 1394serial port, a game port, a USB port, an IR interface, a BLUETOOTH™interface, etc.

A monitor 1646 or other type of display device can be also connected tothe system bus 1608 via an interface, such as a video adapter 1648. Inaddition to the monitor 1646, a computer typically includes otherperipheral output devices (not shown), such as speakers, printers, etc.

The computer 1602 can operate in a networked environment using logicalconnections via wired and/or wireless communications to one or moreremote computers, such as a remote computer(s) 1650. The remotecomputer(s) 1650 can be a workstation, a server computer, a router, apersonal computer, portable computer, microprocessor-based entertainmentappliance, a peer device or other common network node, and typicallyincludes many or all of the elements described relative to the computer1602, although, for purposes of brevity, only a memory/storage device1652 is illustrated. The logical connections depicted includewired/wireless connectivity to a local area network (LAN) 1654 and/orlarger networks, e.g., a wide area network (WAN) 1656. Such LAN and WANnetworking environments are commonplace in offices and companies, andfacilitate enterprise-wide computer networks, such as intranets, all ofwhich can connect to a global communications network, e.g., theInternet.

When used in a LAN networking environment, the computer 1602 can beconnected to the local network 1654 through a wired and/or wirelesscommunication network interface or adapter 1658. The adapter 1658 canfacilitate wired or wireless communication to the LAN 1654, which canalso include a wireless access point (AP) disposed thereon forcommunicating with the adapter 1658 in a wireless mode.

When used in a WAN networking environment, the computer 1602 can includea modem 1660 or can be connected to a communications server on the WAN1656 via other means for establishing communications over the WAN 1656,such as by way of the Internet. The modem 1660, which can be internal orexternal and a wired or wireless device, can be connected to the systembus 1608 via the input device interface 1644. In a networkedenvironment, program modules depicted relative to the computer 1602 orportions thereof, can be stored in the remote memory/storage device1652. It will be appreciated that the network connections shown areexample and other means of establishing a communications link betweenthe computers can be used.

When used in either a LAN or WAN networking environment, the computer1602 can access cloud storage systems or other network-based storagesystems in addition to, or in place of, external storage devices 1616 asdescribed above. Generally, a connection between the computer 1602 and acloud storage system can be established over a LAN 1654 or WAN 1656,e.g., by the adapter 1658 or modem 1660, respectively. Upon connectingthe computer 1602 to an associated cloud storage system, the externalstorage interface 1626 can, with the aid of the adapter 1658 and/ormodem 1660, manage storage provided by the cloud storage system as itwould other types of external storage. For instance, the externalstorage interface 1626 can be configured to provide access to cloudstorage sources as if those sources were physically connected to thecomputer 1602.

The computer 1602 can be operable to communicate with any wirelessdevices or entities operatively disposed in wireless communication,e.g., a printer, scanner, desktop and/or portable computer, portabledata assistant, communications satellite, any piece of equipment orlocation associated with a wirelessly detectable tag (e.g., a kiosk,news stand, store shelf, etc.), and telephone. This can include WirelessFidelity (Wi-Fi) and BLUETOOTH™ wireless technologies. Thus, thecommunication can be a predefined structure as with a conventionalnetwork or simply an ad hoc communication between at least two devices.

Wi-Fi, or Wireless Fidelity, allows connection to the Internet from acouch at home, in a hotel room, or a conference room at work, withoutwires. Wi-Fi is a wireless technology similar to that used in a cellphone that enables such devices, e.g., computers, to send and receivedata indoors and out; anywhere within the range of a base station. Wi-Finetworks use radio technologies called IEEE 802.11 (a, b, g, etc.) toprovide secure, reliable, fast wireless connectivity. A Wi-Fi networkcan be used to connect computers to each other, to the Internet, and towired networks (which use IEEE 802.3 or Ethernet). Wi-Fi networksoperate in the unlicensed 2.4 and 5 GHz radio bands, at an 11 Mbps(802.11a) or 54 Mbps (802.11b) data rate, for example, or with productsthat contain both bands (dual band), so the networks can providereal-world performance similar to the basic 10BaseT wired Ethernetnetworks used in many offices.

It is to be noted that aspects, features, and/or advantages of thedisclosed subject matter can be exploited in substantially any wirelesstelecommunication or radio technology, e.g., Wi-Fi; Gi-Fi; Hi-Fi;BLUETOOTH™; worldwide interoperability for microwave access (WiMAX);enhanced general packet radio service (enhanced GPRS); third generationpartnership project (3GPP) long term evolution (LTE); third generationpartnership project 2 (3GPP2) ultra mobile broadband (UMB); 3GPPuniversal mobile telecommunication system (UMTS); high speed packetaccess (HSPA); high speed downlink packet access (HSDPA); high speeduplink packet access (HSUPA); GSM (global system for mobilecommunications) EDGE (enhanced data rates for GSM evolution) radioaccess network (GERAN); UMTS terrestrial radio access network (UTRAN);LTE advanced (LTE-A); etc. Additionally, some or all of the aspectsdescribed herein can be exploited in legacy telecommunicationtechnologies, e.g., GSM. In addition, mobile as well non-mobile networks(e.g., the internet, data service network such as internet protocoltelevision (IPTV), etc.) can exploit aspects or features describedherein.

Various aspects or features described herein can be implemented as amethod, apparatus, system, or article of manufacture using standardprogramming or engineering techniques. In addition, various aspects orfeatures disclosed in the subject specification can also be realizedthrough program modules that implement at least one or more of themethods disclosed herein, the program modules being stored in a memoryand executed by at least a processor. Other combinations of hardware andsoftware or hardware and firmware can enable or implement aspectsdescribed herein, including disclosed method(s). The term “article ofmanufacture” as used herein is intended to encompass a computer programaccessible from any computer-readable device, carrier, or storage media.For example, computer-readable storage media can include but are notlimited to magnetic storage devices (e.g., hard disk, floppy disk,magnetic strips, etc.), optical discs (e.g., compact disc (CD), digitalversatile disc (DVD), blu-ray disc (BD), etc.), smart cards, and memorydevices comprising volatile memory and/or non-volatile memory (e.g.,flash memory devices, such as, for example, card, stick, key drive,etc.), or the like. In accordance with various implementations,computer-readable storage media can be non-transitory computer-readablestorage media and/or a computer-readable storage device can comprisecomputer-readable storage media.

As it is employed in the subject specification, the term “processor” canrefer to substantially any computing processing unit or devicecomprising, but not limited to, single-core processors;single-processors with software multithread execution capability;multi-core processors; multi-core processors with software multithreadexecution capability; multi-core processors with hardware multithreadtechnology; parallel platforms; and parallel platforms with distributedshared memory. A processor can be or can comprise, for example, multipleprocessors that can include distributed processors or parallelprocessors in a single machine or multiple machines. Additionally, aprocessor can comprise or refer to an integrated circuit, an applicationspecific integrated circuit (ASIC), a digital signal processor (DSP), aprogrammable gate array (PGA), a field PGA (FPGA), a programmable logiccontroller (PLC), a complex programmable logic device (CPLD), a statemachine, a discrete gate or transistor logic, discrete hardwarecomponents, or any combination thereof designed to perform the functionsdescribed herein. Further, processors can exploit nano-scalearchitectures such as, but not limited to, molecular and quantum-dotbased transistors, switches and gates, in order to optimize space usageor enhance performance of user equipment. A processor may also beimplemented as a combination of computing processing units.

A processor can facilitate performing various types of operations, forexample, by executing computer-executable instructions. When a processorexecutes instructions to perform operations, this can include theprocessor performing (e.g., directly performing) the operations and/orthe processor indirectly performing operations, for example, byfacilitating (e.g., facilitating operation of), directing, controlling,or cooperating with one or more other devices or components to performthe operations. In some implementations, a memory can storecomputer-executable instructions, and a processor can be communicativelycoupled to the memory, wherein the processor can access or retrievecomputer-executable instructions from the memory and can facilitateexecution of the computer-executable instructions to perform operations.

In certain implementations, a processor can be or can comprise one ormore processors that can be utilized in supporting a virtualizedcomputing environment or virtualized processing environment. Thevirtualized computing environment may support one or more virtualmachines representing computers, servers, or other computing devices. Insuch virtualized virtual machines, components such as processors andstorage devices may be virtualized or logically represented.

In the subject specification, terms such as “store,” “storage,” “datastore,” data storage,” “database,” and substantially any otherinformation storage component relevant to operation and functionality ofa component are utilized to refer to “memory components,” entitiesembodied in a “memory,” or components comprising a memory. It is to beappreciated that memory and/or memory components described herein can beeither volatile memory or nonvolatile memory, or can include bothvolatile and nonvolatile memory.

By way of illustration, and not limitation, nonvolatile memory caninclude read only memory (ROM), programmable ROM (PROM), electricallyprogrammable ROM (EPROM), electrically erasable ROM (EEPROM), or flashmemory. Volatile memory can include random access memory (RAM), whichacts as external cache memory. By way of illustration and notlimitation, RAM is available in many forms such as synchronous RAM(SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rateSDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), anddirect Rambus RAM (DRRAM).

Additionally, the disclosed memory components of systems or methodsherein are intended to comprise, without being limited to comprising,these and any other suitable types of memory.

As used in this application, the terms “component”, “system”,“platform”, “framework”, “layer”, “interface”, “agent”, and the like,can refer to and/or can include a computer-related entity or an entityrelated to an operational machine with one or more specificfunctionalities. The entities disclosed herein can be either hardware, acombination of hardware and software, software, or software inexecution. For example, a component may be, but is not limited to being,a process running on a processor, a processor, an object, an executable,a thread of execution, a program, and/or a computer. By way ofillustration, both an application running on a server and the server canbe a component. One or more components may reside within a processand/or thread of execution and a component may be localized on onecomputer and/or distributed between two or more computers.

In another example, respective components can execute from variouscomputer readable media having various data structures stored thereon.The components may communicate via local and/or remote processes such asin accordance with a signal having one or more data packets (e.g., datafrom one component interacting with another component in a local system,distributed system, and/or across a network such as the Internet withother systems via the signal). As another example, a component can be anapparatus with specific functionality provided by mechanical partsoperated by electric or electronic circuitry, which is operated by asoftware or firmware application executed by a processor. In such acase, the processor can be internal or external to the apparatus and canexecute at least a part of the software or firmware application. As yetanother example, a component can be an apparatus that provides specificfunctionality through electronic components without mechanical parts,wherein the electronic components can include a processor or other meansto execute software or firmware that confers at least in part thefunctionality of the electronic components. In an aspect, a componentcan emulate an electronic component via a virtual machine, e.g., withina cloud computing system.

In addition, the term “or” is intended to mean an inclusive “or” ratherthan an exclusive “or.” That is, unless specified otherwise, or clearfrom context, “X employs A or B” is intended to mean any of the naturalinclusive permutations. That is, if X employs A; X employs B; or Xemploys both A and B, then “X employs A or B” is satisfied under any ofthe foregoing instances. Moreover, articles “a” and “an” as used in thesubject specification and annexed drawings should generally be construedto mean “one or more” unless specified otherwise or clear from contextto be directed to a singular form.

Moreover, terms like “user equipment” (UE), “mobile station,” “mobile,”“wireless device,” “wireless communication device,” “subscriberstation,” “subscriber equipment,” “access terminal,” “terminal,”“handset,” and similar terminology are used herein to refer to awireless device utilized by a subscriber or user of a wirelesscommunication service to receive or convey data, control, voice, video,sound, gaming, or substantially any data-stream or signaling-stream. Theforegoing terms are utilized interchangeably in the subjectspecification and related drawings. Likewise, the terms “access point”(AP), “base station,” “node B,” “evolved node B” (eNode B or eNB), “homenode B” (HNB), “home access point” (HAP), and the like are utilizedinterchangeably in the subject application, and refer to a wirelessnetwork component or appliance that serves and receives data, control,voice, video, sound, gaming, or substantially any data-stream orsignaling-stream from a set of subscriber stations. Data and signalingstreams can be packetized or frame-based flows.

Furthermore, the terms “user,” “subscriber,” “customer,” “consumer,”“owner,” “agent,” and the like are employed interchangeably throughoutthe subject specification, unless context warrants particulardistinction(s) among the terms. It should be appreciated that such termscan refer to human entities or automated components supported throughartificial intelligence (e.g., a capacity to make inference based oncomplex mathematical formalisms), which can provide simulated vision,sound recognition and so forth.

As used herein, the terms “example,” “exemplary,” and/or “demonstrative”are utilized to mean serving as an example, instance, or illustration.For the avoidance of doubt, the subject matter disclosed herein is notlimited by such examples. In addition, any aspect or design describedherein as an “example,” “exemplary,” and/or “demonstrative” is notnecessarily to be construed as preferred or advantageous over otheraspects or designs, nor is it meant to preclude equivalent exemplarystructures and techniques known to those of ordinary skill in the art.Furthermore, to the extent that the terms “includes,” “has,” “contains,”and other similar words are used in either the detailed description orthe claims, such terms are intended to be inclusive, in a manner similarto the term “comprising” as an open transition word, without precludingany additional or other elements.

It is to be appreciated and understood that components (e.g.,communication device, RAN, cell, base station, communication network,security management component, NN component, feature reformer component,detector component, connection manager component, processor component,data store, or other component), as described with regard to aparticular system or method, can include the same or similarfunctionality as respective components (e.g., respectively namedcomponents or similarly named components) as described with regard toother systems or methods disclosed herein.

What has been described above includes examples of systems and methodsthat provide advantages of the disclosed subject matter. It is, ofcourse, not possible to describe every conceivable combination ofcomponents or methods for purposes of describing the disclosed subjectmatter, but one of ordinary skill in the art may recognize that manyfurther combinations and permutations of the disclosed subject matterare possible. Furthermore, to the extent that the terms “includes,”“has,” “possesses,” and the like are used in the detailed description,claims, appendices and drawings such terms are intended to be inclusivein a manner similar to the term “comprising” as “comprising” isinterpreted when employed as a transitional word in a claim.

What is claimed is:
 1. A method, comprising: based on a first analysisof first signal measurement data representative of first signalmeasurements of first signals associated with a group of cell devices,determining, by a system comprising a processor, a neural network of agroup of neural networks to utilize to determine a representation of acellular network, comprising the group of cell devices; clustering, bythe system using the neural network, respective cell devices of thegroup of cell devices into respective clusters of cell devices based ona second analysis of second signal measurement data representative ofsecond signal measurements of second signals associated with the groupof cell devices; and determining, by the system using the neuralnetwork, whether a defined abnormal condition associated with a celldevice of a cluster of cell devices, of the respective clusters of celldevices, has occurred based on a third analysis of third signalmeasurement data representative of third signal measurements of thirdsignals associated with the group of cell devices and based on a definednetwork security criterion that defines the defined abnormal condition.2. The method of claim 1, wherein the neural network is a first neuralnetwork, wherein the group of neural networks comprises the first neuralnetwork and a second neural network, wherein the first neural network iscreated based on first parameter values of parameters, and wherein thesecond neural network is created based on second parameter values of theparameters.
 3. The method of claim 1, further comprising: as part of thefirst analysis, performing, by the system, feature reforming on thefirst signal measurement data to reduce a dimensionality of vectorsrepresentative of the first signal measurement data to generaterespective frequency feature reduced dimensionality vectors that arerepresentative of the first signal measurement data, wherein the reduceddimensionality is lower than the dimensionality.
 4. The method of claim3, further comprising: as part of the feature reforming: performing, bythe system, a fast Fourier transform on the first signal measurementdata to generate respective frequency feature vectors representative ofthe first signal measurement data; and truncating, by the system,magnitudes of an absolute value of the fast Fourier transform withregard to the respective frequency feature vectors to reduce thedimensionality to generate the respective frequency feature reduceddimensionality vectors.
 5. The method of claim 3, further comprising:respectively encoding, by respective neural networks of the group ofneural networks, the respective frequency feature reduced dimensionalityvectors to generate respective encoded reduced dimensionality vectorsrepresentative of the first signal measurement data, wherein therespective encoded reduced dimensionality vectors have a lowerdimensionality than the respective frequency feature reduceddimensionality vectors.
 6. The method of claim 5, further comprising:respectively decoding, by the system using the respective neuralnetworks, the respective encoded reduced dimensionality vectors togenerate respective decoded versions of the respective encoded reduceddimensionality vectors representative of the first signal measurementdata; comparing, by the system, the respective frequency feature reduceddimensionality vectors to the respective decoded versions of therespective encoded reduced dimensionality vectors; and based on thecomparing, determining, by the system, respective differences betweenthe respective frequency feature reduced dimensionality vectors and therespective encoded reduced dimensionality vectors, wherein thedetermining of the neural network of the group of neural networkscomprises determining the neural network of the group of neural networksto utilize to determine the representation of the cellular network basedon the respective differences, and wherein the neural network isassociated with a smallest difference of the respective differencesrelative to other differences of the respective differences that areassociated with other neural networks of the group of neural networks.7. The method of claim 1, further comprising: performing, by the system,feature reforming of the second signal measurement data to generaterespective frequency feature reduced dimensionality vectors that arerepresentative of the second signal measurement data; encoding, by thesystem using the neural network, the respective frequency featurereduced dimensionality vectors to generate respective encoded reduceddimensionality vectors representative of the second signal measurementdata, wherein the respective encoded reduced dimensionality vectors havea lower dimensionality than the respective frequency feature reduceddimensionality vectors; and determining, by the system using the neuralnetwork, relative distances between the respective encoded reduceddimensionality vectors associated with the respective cell devices,wherein the clustering comprises iteratively clustering, by the systemusing the neural network, the respective cell devices into therespective clusters of cell devices based on the relative distancesbetween the respective encoded reduced dimensionality vectors associatedwith the respective cell devices.
 8. The method of claim 1, comprising:storing, by the system, cluster information relating to the respectiveclusters of cell devices in a cell cluster repository.
 9. The method ofclaim 1, further comprising: performing, by the system, featurereforming of the third signal measurement data to generate respectivefrequency feature reduced dimensionality vectors that are representativeof the third signal measurement data; encoding, by the system using theneural network, the respective frequency feature reduced dimensionalityvectors to generate respective encoded reduced dimensionality vectorsrepresentative of the third signal measurement data, wherein therespective encoded reduced dimensionality vectors have a lowerdimensionality than the respective frequency feature reduceddimensionality vectors, and wherein the respective encoded reduceddimensionality vectors are associated with the respective cell devices;and classifying, by the system using the neural network, the respectivecell devices based on the respective encoded reduced dimensionalityvectors associated with the respective cell devices and informationrelating to the respective clusters of cell devices, wherein thedetermining whether the defined abnormal condition associated with thecell device has occurred comprises determining, by the neural network,whether the defined abnormal condition associated with the cell devicehas occurred based on the classification of the cell device, inaccordance with the defined network security criterion.
 10. The methodof claim 9, wherein the respective encoded reduced dimensionalityvectors comprise an encoded reduced dimensionality vector associatedwith the cell device, and wherein the determining whether the definedabnormal condition associated with the cell device has occurred based onthe classification of the cell device comprises: determining, by thesystem using the neural network, the defined abnormal conditionassociated with the cell device has occurred, in response to determiningthat the encoded reduced dimensionality vector associated with the celldevice is outside of a vector range associated with the cluster of celldevices; or determining, by the system using the neural network, nodefined abnormal condition associated with the cell device has occurred,in response to determining that the encoded reduced dimensionalityvector associated with the cell device is within the vector rangeassociated with the cluster of cell devices.
 11. The method of claim 10,wherein the determining that the defined abnormal condition associatedwith the cell device has occurred indicates that at least one deviceassociated with the cell device is an excessive signaling device. 12.The method of claim 1, wherein the second signal measurement datacomprises same data as, or comprises different data than, the firstsignal measurement data, and wherein the first signal measurement datacomprises a first time series of first signal measurements in a firsttime sequence order, the second signal measurement data comprises asecond time series of second signal measurements in a second timesequence order, and the third signal measurement data comprises a thirdtime series of third signal measurements in a third time sequence order.13. The method of claim 1, wherein the first signal measurement data,the second signal measurement data, or the third signal measurement datacomprise data relating to an attach request signal, an update attachrequest signal, an authentication update request, a packet data networkgateway update request, a connection request signal, or a devicehandover-related signal.
 14. A system, comprising: a processor; and amemory that stores executable instructions that, when executed by theprocessor, facilitate performance of operations, comprising: based on afirst analysis of first signal measurement information associated with agroup of cell devices, determining a neural network of a group of neuralnetworks to utilize to determine a behavioral representation of thegroup of cell devices with regard to signals; clustering, based oninformation from the neural network, respective cell devices of thegroup of cell devices into respective clusters of cell devices based ona second analysis of second signal measurement information associatedwith the group of cell devices, wherein the respective clusters comprisea cluster of cell devices that comprises a cell device; and determining,based on the information from the neural network, whether a definedanomalous condition associated with the cell device has occurred basedon a third analysis of third signal measurement information associatedwith the group of cell devices and based on a defined network securitycriterion relating to defining the defined anomalous condition, whereinthe defined anomalous condition relates to anomalous signaling.
 15. Thesystem of claim 14, wherein the operations further comprise: as part ofthe first analysis, performing feature reforming on the first signalmeasurement information to reduce a dimensionality of vectorsrepresentative of the first signal measurement information to generaterespective frequency feature reduced dimensionality vectors that arerepresentative of the first signal measurement information, wherein thereduced dimensionality is smaller than the dimensionality.
 16. Thesystem of claim 15, wherein the determining of the neural network of thegroup of neural networks to utilize to determine the behavioralrepresentation of the group of cell devices comprises determining theneural network of the group of neural networks based on determining thatthe neural network encodes the respective frequency feature reduceddimensionality vectors to generate respective encoded reduceddimensionality vectors and decodes the respective encoded reduceddimensionality vectors to generate respective decoded versions of therespective encoded reduced dimensionality vectors more accurately thanother neural networks of the group of neural networks, and wherein therespective encoded reduced dimensionality vectors have a smallerdimensionality than the respective frequency feature reduceddimensionality vectors.
 17. The system of claim 14, wherein theoperations further comprise: performing feature reforming of the secondsignal measurement information to generate respective frequency featurereduced dimensionality vectors that are representative of the secondsignal measurement information; encoding, based on the information fromthe neural network, the respective frequency feature reduceddimensionality vectors to generate respective encoded reduceddimensionality vectors representative of the second signal measurementinformation, wherein the respective encoded reduced dimensionalityvectors have a smaller dimensionality than the respective frequencyfeature reduced dimensionality vectors; and determining, based on theinformation from the neural network, relative distances between therespective encoded reduced dimensionality vectors associated with therespective cell devices, wherein the clustering comprises iterativelyclustering, based on the information from the neural network, therespective cell devices into the respective clusters of cell devicesbased on the relative distances between the respective encoded reduceddimensionality vectors associated with the respective cell devices. 18.The system of claim 14, wherein the operations further comprise:performing feature reforming of the third signal measurement informationto generate respective frequency feature reduced dimensionality vectorsthat are representative of the third signal measurement information;encoding, based on the information from the neural network, therespective frequency feature reduced dimensionality vectors to generaterespective encoded reduced dimensionality vectors representative of thethird signal measurement information, wherein the respective encodedreduced dimensionality vectors have a smaller dimensionality than therespective frequency feature reduced dimensionality vectors, and whereinthe respective encoded reduced dimensionality vectors are associatedwith the respective cell devices; and classifying the respective celldevices based on the respective encoded reduced dimensionality vectorsassociated with the respective cell devices and information relating tothe respective clusters of cell devices, wherein the determining whetherthe defined anomalous condition associated with the cell device hasoccurred comprises determining, based on the information from the neuralnetwork, whether the defined anomalous condition associated with thecell device has occurred based on the classification of the cell device,in accordance with the defined network security criterion.
 19. Anon-transitory machine-readable medium, comprising executableinstructions that, when executed by a processor, facilitate performanceof operations, comprising: based on a first evaluation of first signalmeasurement data representative of first measurements of first signalsassociated with a group of cell devices, determining a neural network ofa group of neural networks to employ to determine a signal behaviorrepresentation of the group of cell devices; clustering, via the neuralnetwork, respective cell devices of the group of cell devices intorespective clusters of cell devices based on a second evaluation ofsecond signal measurement data representative of second measurements ofsecond signals associated with the group of cell devices, wherein therespective clusters comprise a cluster of cell devices that comprises acell device; and determining, via the neural network, whether a definedanomalous condition associated with the cell device has occurred basedon a third evaluation of third signal measurement data representative ofthird measurements of third signals associated with the group of celldevices and based on a defined network security criterion that indicateswhat constitutes the defined anomalous condition, wherein the definedanomalous condition relates to excessive signaling.
 20. Thenon-transitory machine-readable medium of claim 19, wherein theoperations further comprise: to facilitate performing encodingassociated with the first signal measurement data, the second signalmeasurement data, or the third signal measurement data, respectively: aspart of the first evaluation, performing feature reforming on the firstsignal measurement data to generate respective first frequency featurereduced dimensionality vectors that are representative of the firstsignal measurement data, wherein the respective first frequency featurereduced dimensionality vectors have a smaller dimensionality than thefirst signal measurement data; as part of the second evaluation,performing feature reforming on the second signal measurement data togenerate respective second frequency feature reduced dimensionalityvectors that are representative of the second signal measurement data,wherein the respective second frequency feature reduced dimensionalityvectors have the smaller dimensionality than the second signalmeasurement data; or as part of the third evaluation, performing featurereforming on the third signal measurement data to generate respectivethird frequency feature reduced dimensionality vectors that arerepresentative of the third signal measurement data, wherein the thirdfrequency feature reduced dimensionality vectors have the smallerdimensionality than the signal measurement data.